Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Tsinghua Unigroup Electronic Archives System allows remote file access
CVE-2026-2683
Summary
The Tsinghua Unigroup Electronic Archives System has a security flaw that allows an attacker to access files they shouldn't be able to. This could happen if someone with malicious intentions can trick the system into giving them access to sensitive files. We recommend that the vendor is contacted to report the issue and provide a patch or update to fix it.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| unigroup | electronic_archives_system | <= 3.2.210802\(62532\) | – |
Original title
A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Subject/downLoad.html. Performing a manip...
Original description
A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Subject/downLoad.html. Performing a manipulation of the argument path results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
4.0
nvd CVSS3.1
4.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-22
Path Traversal
- https://github.com/luoye197-prog/cve-ziguang-fileread3/blob/main/introduce Broken Link
- https://github.com/luoye197-prog/cve-ziguang-fileread3/blob/main/poc.py Broken Link
- https://vuldb.com/?ctiid.346474 Permissions Required VDB Entry
- https://vuldb.com/?id.346474 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.753418 Third Party Advisory VDB Entry
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026