The vulnerability resides in the installByPath module of jshERP, where the install function accepts a path argument that is not properly validated. An attacker who can trigger this function can supply a crafted path containing traversal sequences, causing the application to write or overwrite files outside the intended plugin directory. This flaw allows the creation or modification of arbitrary files on the filesystem, potentially enabling the execution of malicious code or the alteration of critical configuration files.

Jishenghua jshERP releases up to and including version 3.6 are affected. The issue remains unpatched, so any deployment of these versions that exposes the installByPath endpoint to the network remains vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS indicates a very low probability of exploitation (<1%) and the vulnerability is not listed in the CISA KEV catalog. A publicly available exploit exists, and attackers only need network access to the installByPath endpoint; no elevated local privileges are required. The exploitation path is straightforward: send a carefully crafted path value to the endpoint to force the application to write an arbitrary file.