Critical severity · published Feb 22, 2026
CVE-2026-2953
Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal
9.1
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UJ
UJCMS · Dromara
101.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2953
Permissions Required
https://vuldb.com/?ctiid.347319
Third Party Advisory
https://vuldb.com/?id.347319
Third Party Advisory
https://vuldb.com/?submit.755215
Exploit
https://www.yuque.com/la12138/pa2fpb/lxngf3d07uyd0nwp?singleDoc
More from UJCMS
9.8
CVE-2026-2954
Dromara UJCMS ImportDataController import-channel importChanel injection
9.8
CVE-2023-51350
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the…
9.8
CVE-2023-34865
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature
9.8
CVE-2023-34747
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload
7.5
CVE-2023-34878
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip