CVE-2026-2684 is an unrestricted file upload (CVSS 7.3, high) in Tsinghua Unigroup Electronic Archives System up to version 3.2.210802(62532), in the uploadFile.html handler. The vendor did not respond to the disclosure and no fix is confirmed, so limit access to the application.
What's affected
The record names Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The file is /Archive/ErecordManage/uploadFile.html and the argument is File.
The vendor did not answer the early contact, and the record says the exploit is public. No fixed build is named.
How to check if you're exposed
Check your installed build number. Anything up to 3.2.210802(62532) is in range. Then review the upload directory for files you do not recognize, in particular script or executable types, and check web logs for POST requests to the upload page from unexpected addresses.
What to do now
- Identify installs of the product and the version.
- Restrict the application to a VPN or allow list.
- Make sure the upload directory is not executable by the web server and is not served as code.
- Review recent uploads for unexpected file types and investigate any you find.
- Ask the vendor for a fixed build in writing and record the answer.
Why it matters
The record lists CWE-434 (unrestricted upload of a dangerous file type) and CWE-284 (improper access control). When an application accepts any file and stores it where the server can run or serve it, the upload feature becomes a way in.
The usual defenses are an allow list of file types, renaming on save, storage outside the web root and no execute permission. Without a vendor fix, you can still apply several of those at the web server layer.
Quick check
Is this one related to CVE-2026-2682?
Same product, different flaw. That one is SQL injection in a report page. Both lack a vendor fix in the record.
Sources
- CVE-2026-2684 on Gold
- NVD record for CVE-2026-2684, published 19 February 2026
- VulDB entry listed in the record: https://vuldb.com/?id.346475
Last reviewed: 19 October 2026.
