Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-4284: Critical issue in PPT File Handler of taoofagi easegen-admin allows remote attacks

CVE-2026-4284 · published 7 months ago

Summary

A critical issue in the PPT File Handler of taoofagi easegen-admin allows attackers to remotely access and manipulate system resources, potentially leading to unauthorized access. This issue is currently being exploited and has been publicly disclosed. Since the vendor has not responded, it's essential to take steps to protect your system as soon as possible.

Original advisory text

A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of the component PPT File Handler. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published16 Mar 2026

Updated4 Nov 2026

First seen16 Mar 2026

Sources

CVE-2026-4284 · NVD

Track software like this

Free during beta