Improper file permissions in Japan's delivery item inspection system
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Electronic delivery item Inspection Support System from Japan's Ministry of Land, Infrastructure, Transport and Tourism is affected from 0 through Ver.4.0.36. Incorrect default permissions (CWE-276) let files in the application's installation folder be tampered with. A local user with low privileges can modify these files, resulting in arbitrary code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic delivery item Inspection Support System | up to Ver.4.0.36 | — | No fix listed | CNA |
- Electronic delivery item Inspection Support System VendorMinistry of Land, Infrastructure, Transport and Tourism, Japan Affected up to Ver.4.0.36 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Electronic delivery item Inspection Support System.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-26 Threatist record created from CVE-2026-113345
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-r6vq-m3xv-fg74
References
Sources
- CVE-2026-113345 · CVE Program
- CVE-2026-113345 · NVD
- FIRST EPSS
- GHSA-r6vq-m3xv-fg74 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences