xiweicheng TMS up to 2.28.0 Remote Code Execution (RCE) Vulnerability (CVE-2026-1061)
Executive & SecOps Summary
SECOPS ASSESSMENTxiweicheng TMS up to and including version 2.28.0
Unauthenticated remote attackers can upload arbitrary malicious files, leading to Remote Code Execution (RCE) on the target server
Disable execution permissions on the upload directory, enforce strict file extension validation, or apply the latest security patches
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Verify and apply the latest official security patches from the vendor. If you are managing the application from source, pull the latest secure branch and rebuild the package.
# Pull the latest secure updates from the repository
git pull origin main
# Rebuild the Maven project to apply code changes
mvn clean package -DskipTests2. Temporary Workaround & Hardening Configuration
If patching cannot be immediately performed, implement strict access controls and disable script execution in the upload directory using a reverse proxy like Nginx.
# Block execution of active script extensions in the upload directory
location ~* ^/uploads/.*\.(jsp|jspx|sh|asp|aspx|php)$ {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Use the following commands to inspect the server for suspicious JSP files and audit application logs for unauthorized upload attempts.
# 1. Search for recently modified or created JSP files in the web directory
find /var/www/html/ -name '*.jsp' -mtime -10 -print
# 2. Audit application logs for FileController access containing executable extensions
grep -i 'FileController' /var/log/app/tms-access.log | grep -E '\.(jsp|jspx|sh)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is an unrestricted file upload flaw (CWE-434) identified in the xiweicheng TMS solution. The root cause resides within the Upload function of the src/main/java/com/lhjz/portal/controller/FileController.java file. Due to insufficient validation and sanitization of the user-supplied filename parameter, the application permits the storage of arbitrary files directly onto the server's filesystem, exposing a critical security gap.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the file upload endpoint managed by FileController. By manipulating the filename parameter to specify an executable extension (such as .jsp or .jspx) and embedding malicious payload code within the request body, the attacker bypasses non-existent or weak validation checks. Once the file is successfully written to a web-accessible directory, the attacker can trigger execution by directly requesting the uploaded file's URL, achieving arbitrary command execution.
3. Infrastructure & Business Impact
Assessed with a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk as it requires no prior authentication and can be exploited remotely. Successful exploitation grants the attacker the execution privileges of the web application server process. This can lead to full system compromise, lateral movement within the internal network, sensitive database exfiltration, deployment of ransomware, and severe operational disruption.
Official Vendor Advisories & References
A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used.
Frequently Asked SecOps Questions (CVE-2026-1061)
FAQQ1. How critical is CVE-2026-1061 and is it actively exploited in the wild?
CVE-2026-1061 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 0.4%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-1061?
Primary impacted vendors include xiweicheng across tms. Scope summary: All versions of xiweicheng TMS up to and including 2.28.0
Q3. What temporary mitigations or workarounds exist for CVE-2026-1061 before patching?
[Mitigation] Disable execution permissions on the upload directory, enforce strict file extension validation, or apply the latest security patches Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-1061
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (xiweicheng)
View Category →Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)
[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0
Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)
[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8
Joomla SP Page Builder Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2026-48908)
[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla
Joomla Balbooa Forms Extension Unauthenticated Remote Code Execution Vulnerability (CVE-2026-56291)
[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.