CVE-2026-96678 | weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f Avatar Upload NewUserFormValidator.java validate Username path traversal

September 23, 2026 Yanac

A vulnerability was found in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. It has been classified as critical. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal.

This vulnerability is documented as CVE-2026-96678. The attack can be initiated remotely. Additionally, an exploit exists.

Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More