CVE-2026-2863

A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function deleteFile of the file FileServiceImpl.java. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-22

• https://github.com/megagao/production_ssm/issues/37
• https://github.com/megagao/production_ssm/issues/37#issue-3914979380
• https://vuldb.com/?ctiid.347102
• https://vuldb.com/?id.347102
• https://vuldb.com/?submit.754530

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28622In getQueryBuilderInternal of MediaProvider.java, there is a…3.3
• CVE-2026-28623In writeToParcel of BleRssiRangingCapabilities.java, there i…3.3
• CVE-2026-28624In multiple locations, there is a possible read/write access…7.8
• CVE-2026-28625In multiple locations, there is a possible permission bypass…7.8
• CVE-2026-28626In onCreate of SetupPassthroughActivity.java, there is a pos…7.3
• CVE-2026-28627In btm_sec_encrypt_change of btm_sec.cc, there is a possible…4.3
• CVE-2026-28630In onCreate of ContactsPickerActivity.kt, there is a possibl…3.3
• CVE-2026-28631In buildMiniResolver of IntentForwarderActivity.java, there …7.8
• CVE-2026-28633In initForUserNoTracing of VoiceInteractionManagerService.ja…5.5
• CVE-2026-28634In handleUssdRequest of PhoneInterfaceManager.java, there is…7.8
• CVE-2026-28636In setupLayout of PickActivity.java, there is a possible byp…7.8
• CVE-2026-28638In multiple functions of XmpDataParser.java, there is a poss…3.3