CVE-2026-1062

MediumPublic PoC

Published: 17 January 2026

Published

17 January 2026

Modified

08 March 2026

KEV Added

—

Patch

—

CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0002 6.5th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1062 is a medium-severity SSRF (CWE-918) vulnerability in Xiweicheng Teamwork Management System. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing web app directly enables remote exploitation of the application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit…

has been published and may be used.

Deeper analysisAI

CVE-2026-1062 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting xiweicheng TMS versions up to 2.28.0. The flaw is located in the file src/main/java/com/lhjz/portal/util/HtmlUtil.java, where manipulation of the 'url' argument triggers the SSRF condition. Published on 2026-01-17, it carries a CVSS 3.1 base score of 6.3.

A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing the scope (S:U). Exploitation enables limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing the attacker to make unauthorized requests from the server.

Advisories and related details are documented in references such as GitHub repositories detailing SSRF exploits and VulDB entries (ctiid.341630, id.341630, submit.731241). No specific patch or mitigation steps are outlined in the CVE description.

The exploit has been published and may be used, indicating potential for active exploitation.