CVE-2026-3187
Published: 25 February 2026
Summary
CVE-2026-3187 is a medium-severity Improper Access Control (CWE-284) vulnerability in Szadmin Sz-Boot-Parent. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2026-3187 is an unrestricted file upload vulnerability (CWE-284, CWE-434) affecting the feiyuchuixue sz-boot-parent project in versions up to 1.3.2-beta. The issue resides in an unknown functionality of the /api/admin/sys-file/upload API endpoint, which permits manipulation leading to unrestricted uploads without proper validation of file types or content.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network-accessible exploitation with low complexity and low privileges required. An authenticated attacker with basic access (PR:L) can remotely upload arbitrary files via the endpoint, potentially compromising confidentiality, integrity, and availability to a low degree, such as executing malicious code if server-side execution is possible.
Mitigation is available via upgrade to version 1.3.3-beta, which includes patch commit aefaabfd7527188bfba3c8c9eee17c316d094802. The project introduced whitelist restrictions on the /api/admin/sys-file/upload endpoint using the oss.allowedExts and oss.allowedMimeTypes configuration options to limit permitted file extensions and MIME types. The vendor was notified in advance and responded professionally by implementing these controls.
A public proof-of-concept exploit is available, increasing the risk of targeted attacks against deployments using vulnerable versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8659
Vulnerability details
A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The…
more
exploit is publicly available and might be used. Upgrading to version 1.3.3-beta can resolve this issue. The name of the patch is aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is recommended. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload on a network-accessible admin API endpoint directly enables exploitation of public-facing web applications (T1190) and facilitates deployment of malicious web shells for code execution/persistence (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of file uploads to enforce allowed extensions and MIME types on the /api/admin/sys-file/upload endpoint.
Provides malicious-code scanning and blocking mechanisms that can detect or prevent execution of arbitrary uploaded files.
Enforces least functionality by restricting the upload capability to only explicitly permitted file types via configuration.