CVE-2026-1062 is a medium (CVSS 6.3) server-side request forgery in xiweicheng TMS, a teamwork management system, up to version 2.28.0, in the Summary function of HtmlUtil.java through the url argument. The record names no fixed release. Check the project, restrict outbound traffic from the server, and limit who can sign in.
What's affected
The record names xiweicheng TMS up to 2.28.0 and the Summary function in src/main/java/com/lhjz/portal/util/HtmlUtil.java, where the url argument is the problem input.
The record names no fixed version and says nothing about the vendor's response. Check the project's releases and issue tracker before assuming any particular later release is safe.
How to check if you're exposed
Check which version you run, and whether the Java archive in your deployment includes the code:
unzip -l tms.jar | grep -i HtmlUtil
Your jar or war may be named differently. Then check who can reach the application, and whether the server can make outbound requests to internal addresses such as your cloud metadata service or private network ranges. That reachability decides how much an SSRF can do.
What to do now
- Check the project for a release after 2.28.0 and apply it if there is one.
- Restrict outbound traffic from the TMS server so it can only reach what it needs.
- Block access from the server to cloud metadata endpoints and to internal admin services.
- Limit sign-ins to people who need them, since the vector lists low privileges.
- If you maintain the code, validate the url argument against an allow list of schemes and hosts.
Why it matters
SSRF, filed as CWE-918, means the server is tricked into making a request for the attacker. The server often sits inside a network and has access the attacker lacks, such as internal services and cloud metadata addresses.
A function that fetches a page to build a summary is a typical source. It takes a URL from the user and requests it. A safe version checks the scheme, resolves the host, refuses private ranges, and does not follow redirects blindly.
The score is 6.3 because the vector shows low privileges and only low impact. The real impact depends on what the server can reach. The record says the exploit is public. It does not report exploitation in the wild, and the KEV flag is false.
Quick check
Is SSRF dangerous if my server has no internal services?
It is less dangerous, but cloud metadata addresses and other hosts on the same network still count. Restrict outbound traffic either way.
Sources
Last reviewed: 19 October 2026.
