CVE-2026-2683

A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Subject/downLoad.html. Performing a manipulation of the argument path results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/luoye197-prog/cve-ziguang-fileread3/blob/main/introduceBroken Link
• https://github.com/luoye197-prog/cve-ziguang-fileread3/blob/main/poc.pyBroken Link
• https://vuldb.com/?ctiid.346474Permissions Required, VDB Entry
• https://vuldb.com/?id.346474Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.753418Third Party Advisory, VDB Entry

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2681A flaw was found in the blst cryptographic library. This out…5.3
• CVE-2026-2682A vulnerability has been found in Tsinghua Unigroup Electron…9.8
• CVE-2026-26824libxls through version 1.6.3 contains a use of uninitialized…6.5
• CVE-2026-26825A use-of-uninitialized memory vulnerability exists in libxls…5.3
• CVE-2026-26828A NULL pointer dereference in the daap_reply_playlists funct…7.5
• CVE-2026-26829A NULL pointer dereference in the safe_atou64 function (src/…7.5
• CVE-2026-26830pdf-image (npm package) through version 2.0.0 allows OS comm…9.8
• CVE-2026-26831textract through 2.5.0 is vulnerable to OS Command Injection…9.8
• CVE-2026-26832node-tesseract-ocr is an npm package that provides a Node.js…9.8
• CVE-2026-26833thumbler through 1.1.2 allows OS command injection via the i…9.8
• CVE-2026-2684A vulnerability was determined in Tsinghua Unigroup Electron…9.8
• CVE-2026-2686A security vulnerability has been detected in SECCN Dingchen…9.8