CVE-2026-4201 identifies an unrestricted upload vulnerability in glowxq glowxq-oj, specifically affecting the Upload function in `SysFileController.java` up to commit 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability carries a CVSS v3.1 score of 7.3 High, enabling an unauthenticated remote attacker to exploit it with low complexity, potentially impacting confidentiality, integrity, and availability. Public exploit code has been made available, however, there is no indication of active exploitation, KEV listing, or significant community discussion at this time. The vendor has not responded to disclosure attempts, and specific affected versions are unavailable due to a lack of product versioning.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Glowxq | Glowxq-Oj | 6f7c723090472057252040fd2bbbdaa1b5ed2393CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.