Critical severity · published Feb 22, 2026
CVE-2026-2954
Dromara UJCMS ImportDataController import-channel importChanel injection
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UJ
UJCMS · Dromara
10.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2954
Permissions Required
https://vuldb.com/?ctiid.347320
Third Party Advisory
https://vuldb.com/?id.347320
Third Party Advisory
https://vuldb.com/?submit.755222
Broken Link
https://www.yuque.com/la12138/pa2fpb/gsz2l14wlz8c4nsn?singleDoc
More from UJCMS
9.8
CVE-2023-51350
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the…
9.8
CVE-2023-34865
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature
9.8
CVE-2023-34747
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload
9.1
CVE-2026-2953
Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal
7.5
CVE-2023-34878
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip