CVE-2026-2954: Dromara UJCMS ImportDataController import-channel importChanel injection
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2954?
The severity of CVE-2026-2954 is rated as high due to the potential for remote code execution through improper input validation.
How do I fix CVE-2026-2954?
To fix CVE-2026-2954, update Dromara UJCMS to the latest version that includes patches addressing this vulnerability.
What type of vulnerability is CVE-2026-2954?
CVE-2026-2954 is categorized as an injection vulnerability, allowing attackers to manipulate input parameters.
What components are affected by CVE-2026-2954?
CVE-2026-2954 affects the ImportDataController component, specifically the importChanel function in the Dromara UJCMS framework.
What are the potential impacts of CVE-2026-2954?
The potential impacts of CVE-2026-2954 include unauthorized access and control over the application through malicious input.