UJCMS vulnerabilities

2 known vulnerabilities in UJCMS from Dromara. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  UJCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-2954Feb 22, 2026Dromara

  A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in inj

• 9.1 Critical severity

  UJCMS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-2953Feb 22, 2026Dromara

  A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from r