CVE-2026-7676 Detail

Nvd.Nist • May 3, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early this disclosure but did not respond in any way.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in kerwincui FastBee Software Two critical vulnerabilities have been identified in kerwincui FastBee versions up to 1.2.1. CVE-2026-7676 affects the Tool Download Endpoint, allowing path traversal through the fileName argument in the ToolController.download function. CVE-2026-7677 impacts the System Notice Handler, enabling cross-site scripting via the noticeContent argument in the SysNoticeController.Add function. Both vulnerabilities can be exploited remotely, and the exploits have been publicly disclosed. The vendor was contacted prior to disclosure but did not respond. These vulnerabilities pose significant risks to users of the FastBee software, potentially leading to unauthorized access and data manipulation. Immediate attention is required for affected systems to mitigate these risks. 2 sources 72

Extracted Entities

CVE-2026-7676 Detail

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)