CVE-2026-1062
Published: 17 January 2026
Summary
CVE-2026-1062 is a medium-severity SSRF (CWE-918) vulnerability in Xiweicheng Teamwork Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-1062 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting xiweicheng TMS versions up to 2.28.0. The flaw is located in the file src/main/java/com/lhjz/portal/util/HtmlUtil.java, where manipulation of the 'url' argument triggers the SSRF condition. Published on 2026-01-17, it carries a CVSS 3.1 base score of 6.3.
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing the scope (S:U). Exploitation enables limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing the attacker to make unauthorized requests from the server.
Advisories and related details are documented in references such as GitHub repositories detailing SSRF exploits and VulDB entries (ctiid.341630, id.341630, submit.731241). No specific patch or mitigation steps are outlined in the CVE description.
The exploit has been published and may be used, indicating potential for active exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3131
Vulnerability details
A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit…
more
has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing web app directly enables remote exploitation of the application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the untrusted 'url' argument in HtmlUtil.java before any outbound request is performed, directly blocking the SSRF vector.
Enforces information-flow policy that restricts the application from initiating arbitrary server-side requests to user-supplied destinations.
Boundary-protection mechanisms can filter or log unauthorized outbound connections initiated by the vulnerable Summary function.