{"id":"CVE-2026-7519","state":"PUBLISHED","title":"Fujian Apex LiveBOS Endpoint UploadImage.do path traversal","description":"A vulnerability has been found in Fujian Apex LiveBOS up to 2.0. Impacted is an unknown function of the file /feed/UploadImage.do of the component Endpoint. Such manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1 is recommended to address this issue. Upgrading the affected component is advised.","publishedAt":"2026-05-01T00:45:38.424Z","updatedAt":"2026-05-01T14:15:54.655Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Fujian Apex LiveBOS"],"affected":[{"vendor":"Fujian Apex","product":"LiveBOS","versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"unaffected"}],"modules":["Endpoint"]}],"references":["https://vuldb.com/vuln/360333","https://vuldb.com/vuln/360333/cti","https://vuldb.com/submit/804096","https://my.feishu.cn/docx/TCyMdptvaoTQCvxkHLbceJZCnge?from=from_copylink"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7519.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7519","state":"PUBLISHED","datePublished":"2026-05-01T00:45:38.424Z","dateUpdated":"2026-05-01T14:15:54.655Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-30T16:30:58.306Z"},"containers":{"cna":{"title":"Fujian Apex LiveBOS Endpoint UploadImage.do path traversal","descriptions":[{"lang":"en","value":"A vulnerability has been found in Fujian Apex LiveBOS up to 2.0. Impacted is an unknown function of the file /feed/UploadImage.do of the component Endpoint. Such manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1 is recommended to address this issue. Upgrading the affected component is advised."}],"affected":[{"vendor":"Fujian Apex","product":"LiveBOS","versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"unaffected"}],"modules":["Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/360333","name":"VDB-360333 | Fujian Apex LiveBOS Endpoint UploadImage.do path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360333/cti","name":"VDB-360333 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804096","name":"Submit #804096 | FUJIAN APEX SOFTWARE CO., LTD. LiveBOS <2.1 Remote Code Execution","tags":["third-party-advisory"]},{"url":"https://my.feishu.cn/docx/TCyMdptvaoTQCvxkHLbceJZCnge?from=from_copylink","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"Path Traversal"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-05-01T00:45:38.424Z"},"timeline":[{"time":"2026-04-30T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-30T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-30T18:36:03.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"0menc (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-01T14:10:52.596370Z","id":"CVE-2026-7519","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-01T14:15:54.655Z"}}]}}}