The CVE-2026-2864 vulnerability arises from a path traversal flaw in the pictureDelete function of PictureController.java. The flaw is triggered when an attacker supplies a specially crafted picName argument, causing the application to resolve a file path that escapes the intended directory. Because the vulnerability is exploitable remotely through a standard HTTP request, an attacker with network access to the service can attempt to influence the file path used for deletion. The weakness is a classic example of CWE‑22, whereby the application fails to properly constrain the file system locations it accesses.

Affected vendors include feng_ha_ha and megagao, each offering the production_ssm and ssm‑erp products. The path traversal flaw exists in all releases up to commit 4288d53bd35757b27f2d070057aefb2c07bdd097. Since the project does not use traditional versioning, no specific version numbers are available, and the flaw is only identified by the commit hash. The application is distributed under two separate project names.

The CVSS base score is 5.3, indicating a medium severity issue. The EPSS score is below 1 %, suggesting a low likelihood of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires only network connectivity to the application’s endpoint and the ability to send a crafted picName value. The fact that the exploit has been publicly disclosed implies knowledge of the vulnerability, but no official patch or workaround has yet been released. Until corrective action is taken, the risk remains, particularly if the application is exposed to untrusted users.