The PluginController in jshERP includes an uploadPluginConfigFile function that accepts a configFile argument. The current implementation does not sanitize this parameter, resulting in a path traversal flaw. An attacker can supply crafted values for configFile, causing the application to resolve file paths outside of the intended directory structure. This flaw enables remote attackers to read arbitrary files or, depending on the server configuration, write files that could be executed or used in further attacks.

Affected systems are installations of jshERP from the vendor Jishenghua up to version 3.6. The product is hosted at jishenghua/jshERP on GitHub. No higher versions have been identified in the data, so any deployment of version 3.6 or earlier is potentially vulnerable.

The CVSS base score is 5.3 indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation under current threat landscapes. However, the vulnerability is publicly documented, and an exploit is available. Attackers can invoke the flaw remotely by sending a crafted HTTP request to the /jshERP-boot/plugin/uploadPluginConfigFile endpoint using the configFile parameter. Because the flaw does not require local privileges, the impact can affect confidentiality and integrity of files on the server.