CVE-2026-2953: Path Traversal in UJCMS Template Handler

CVE-2026-2953 is a medium severity flaw (CVSS 5.4) in Dromara UJCMS 101.2. The deleteDirectory function behind the template delete action can be manipulated into a path traversal, so a user can act on directories outside the intended location. It can be attempted remotely by an authenticated user, and the exploit is public.

What's affected

The NVD record lists Dromara UJCMS version 101.2. The NVD record does not name a fixed version, so assume every copy you run is exposed until the maintainer says otherwise. The vendor was contacted early about this disclosure but did not respond, according to the record. The public disclosure and the record are the only sources for this issue.

How to check if you're exposed

Find out whether Dromara UJCMS 101.2 runs anywhere in your environment, including test servers and old demos. Check your UJCMS version in the admin panel and compare it with 101.2.

Then check who can reach it. A copy that is open to the internet is the case that matters most, so review the web server, reverse proxy and firewall rules for that host.

What to do now

1. Remove Dromara UJCMS 101.2 from any internet-facing host, or restrict it to a trusted network or VPN.
2. Check the project page and the maintainer's contact channels for a fix, and apply it if one has appeared since this was written.
3. Limit back office access to trusted users and networks, since the vector needs a login.
4. Review accounts that can manage templates, and remove any that do not need that right.
5. Take a file level backup of the site, because the weak action deletes directories.
6. Keep a list of small third party applications like this one, so a new advisory can be matched against it quickly. The Gold page for this CVE has the latest data: https://gold.safeguard.sh/vulnerability/CVE-2026-2953

Why it matters

The record files this under CWE-22. The record files this under CWE-22, path traversal. The code builds a file path from user input and does not stop the path from climbing out of the folder it should stay in. Here the action is a directory delete, which makes data loss the main concern. The maintainer must canonicalise the path and check that it stays inside the template folder.

The NVD description says the exploit is public, so anyone can read how the weakness works. A public write-up and no vendor fix is a poor mix for a system that holds real data, which is why exposure control is the main defence here. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.

Quick check

Sources

• NVD record

Last reviewed: 19 October 2026.