CVE-2026-78140: dromara ujcms Incomplete Filtering of Special Elements

Vulnerability summary

CVE-2026-78140 is a medium (CVSS 5.8) Incomplete Filtering of Special Elements vulnerability in dromara ujcms. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-08-2026
   PublishedVulnerability first disclosed.
2. 24-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.

• CWE-791Incomplete Filtering of Special ElementsThe product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.