CVE-2026-2557— cskefu File Upload MediaController.java upload cross site scripting
Quick assessment
Affected
n/a cskefu
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
cskefu（春松客服）是中国Chatopera开源的一种开源、免费的智能客服系统。 cskefu（春松客服）8.0.1及之前版本存在跨站脚本漏洞，该漏洞源于文件com/cskefu/cc/controller/resource/MediaController.java中组件File Upload的函数Upload存在跨站脚本问题，可能导致远程攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-2557
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
cskefu File Upload MediaController.java upload cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the component File Upload. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
cskefu（春松客服） 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
cskefu（春松客服）是中国Chatopera开源的一种开源、免费的智能客服系统。 cskefu（春松客服）8.0.1及之前版本存在跨站脚本漏洞，该漏洞源于文件com/cskefu/cc/controller/resource/MediaController.java中组件File Upload的函数Upload存在跨站脚本问题，可能导致远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | cskefu | 8.0.0 |
cpe:2.3:a:cskefu:cskefu:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-2557
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2557
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-02-16 · 17 CVEs total
| CVE-2026-2542 | 7.0 HIGH | Total VPN win-service.exe unquoted search path |
| CVE-2026-2558 | 6.3 MEDIUM | GeekAI net_handler.go Download server-side request forgery |
| CVE-2026-2556 | 6.3 MEDIUM | cskefu Endpoint MediaController.java server-side request forgery |
| CVE-2026-2531 | 6.3 MEDIUM | MindsDB File Upload security.py clear_filename server-side request forgery |
| CVE-2026-2552 | 5.5 MEDIUM | ZenTao Editor control.php delete path traversal |
| CVE-2026-2551 | 5.4 MEDIUM | ZenTao Backup control.php delete path traversal |
| CVE-2026-2525 | 5.3 MEDIUM | Free5GC PFCP UDP Endpoint denial of service |
| CVE-2026-2524 | 5.3 MEDIUM | Open5GS MME mme_s11_handle_create_session_response denial of service |
| CVE-2026-2523 | 5.3 MEDIUM | Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion |
| CVE-2026-2555 | 5.0 MEDIUM | JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZ |
| CVE-2026-2547 | 3.5 LOW | LigeroSmart index.pl AgentDashboard cross site scripting |
| CVE-2026-2546 | 3.5 LOW | LigeroSmart index.pl cross site scripting |
| CVE-2026-2545 | 3.5 LOW | LigeroSmart index.pl cross site scripting |
| CVE-2025-65716 | Markdown Preview Enhanced 安全漏洞 | |
| CVE-2025-65715 | Code Runner 安全漏洞 | |
| CVE-2025-65717 | Live Server 安全漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-92727
EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cr -
CVE-2026-92826
EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripti -
CVE-2026-92538
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripti -
CVE-2026-92977
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 -
CVE-2026-92551
Paid Membership Plugin, Ecommerce, User Registration Form, L
V. Comments for CVE-2026-2557
No comments yet