Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

published 2018-10-30 8y ago modified 2026-06-17 4mo ago also GHSA-c7c7-xm8g-xm36 , EUVD-2018-0744

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.

Is CVE-2018-18830 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	net.mingsoft:ms-mcms	<=4.6.5	no fix listed

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

gitee.com /mingSoft/MCMS/issues/IO0IQ
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-18830
advisory
gitee.com /mingSoft/MCMS
package
github.com /advisories/GHSA-c7c7-xm8g-xm36
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.