CVE-2026-19761

MEDIUM 4.7

DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

CWE	CWE-22
Vendor	dtstack
Product	taier
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for dtstack taier

Be the first to know when new medium vulnerabilities affecting dtstack taier are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

DTStack / Taier

1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/389664 vuldb.com: https://vuldb.com/vuln/389664/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19761 vuldb.com: https://vuldb.com/submit/868965 github.com: https://github.com/DTStack/Taier/issues/1202 github.com: https://github.com/DTStack/Taier/commit/572773c4315e23e51e30115151cb091749a8d03e github.com: https://github.com/DTStack/Taier/releases/tag/v1.5.0 github.com: https://github.com/DTStack/Taier/

Credits

🔍 Ku4D3 (VulDB User)