CVE-2026-29909

Published March 30th, 2026

View on NVD ↗

CVSS v3

5.3

MEDIUM

CVSS v2

N/A

Affected

PROJECTS

Description

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials.

wuweiit/mushroom

MRCMS 是一款基于Java的智能内容管理系统，支持扩展、主题、AI (暂停维护，移步mrcms-v4)

GitHub

224

qflksheep/CVE-2026-29909-MRCMS-vulnerability

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The `/admin/file/list.do` endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials.

GitHub