CVE-2026-1061

A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used.

• CWE-284
• CWE-434
• CWE-434

• https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.341629Permissions Required, VDB Entry
• https://vuldb.com/?id.341629Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.731240Third Party Advisory, VDB Entry

Published

Jan 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10600Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6…4.3
• CVE-2026-10601A user with Viewer permissions can use specially crafted req…4.3
• CVE-2026-10606A vulnerability was determined in DedeCMS 5.7.88. The affect…7.3
• CVE-2026-10607A vulnerability was identified in DedeCMS 5.7.88. The impact…7.3
• CVE-2026-10608A security flaw has been discovered in DedeCMS 5.7.88. This …7.3
• CVE-2026-10609A missing authorization flaw was found in the OpenShift Clus…6.8
• CVE-2026-10610Local privilege escalation potentially allowed an attacker t…8.5
• CVE-2026-10611An authentication bypass vulnerability exists in MISP when L…10
• CVE-2026-10616A weakness has been identified in nextlevelbuilder GoClaw up…4.3
• CVE-2026-10617A security vulnerability has been detected in nextlevelbuild…7.3
• CVE-2026-10618Hugo's default fenced-code-block renderer writes attribute v…5.4
• CVE-2026-10619A vulnerability was detected in sayan365 student-management-…7.3