CVE-2026-4201 - glowxq glowxq-oj SysFileController.java upload unrestricted upload

Back Back to CVE browser

MEDIUM

glowxq glowxq-oj SysFileController.java upload unrestricted upload

Published Mar 16, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 1.26%

Description

A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file business/business-system/src/main/java/com/glowxq/system/admin/controller/SysFileController.java. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Glowxq Product Glowxq-OJ Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glowxq

Glowxq-OJ

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (4)

https://fx4tqqfvdw4.feishu.cn/docx/XM7MdiAtxodVIOx5HXScEdOsn47?from=from_copylink
exploit
https://vuldb.com/?ctiid.351113
signaturepermissions-required
https://vuldb.com/?id.351113
vdb-entrytechnical-description
https://vuldb.com/?submit.770477
third-party-advisory

Link	Providers	Tags
https://fx4tqqfvdw4.feishu.cn/docx/XM7MdiAtxodVIOx5HXScEdOsn47?from=from_copylink		exploit
https://vuldb.com/?ctiid.351113		signaturepermissions-required
https://vuldb.com/?id.351113		vdb-entrytechnical-description
https://vuldb.com/?submit.770477		third-party-advisory