CVE-2026-6487

OVERVIEW A path traversal vulnerability (CVE-2026-6487) has been identified in Qihui jtbc5 CMS version 5.0.3.6. The flaw exists in the /dev/code/common/diplomat/manage.php file within the Code Endpoint component, where improper handling of the path parameter allows unauthorized directory traversal attacks. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM severity) with a network-based attack vector requiring low complexity and valid user credentials. The impact is limited to confidentiality compromise, as attackers can read sensitive files, with no direct impact on data integrity or system availability. The FAUCET Risk Score of 30.0/100 reflects moderate organizational risk. EXPLOITATION STATUS Public exploit code is available and actively circulating. The vulnerability is listed on the Hot List indicating heightened community interest and monitoring. However, the exploit has not yet been observed in widespread active exploitation campaigns, with an EPSS score of 0.00044 indicating minimal probability of exploitation in the wild at this time. The vendor has not responded to early disclosure attempts, leaving the vulnerability unpatched.