CVE-2026-3187 is an unrestricted file upload in sz-boot-parent, a Java admin framework, up to 1.3.2-beta. NVD scores it 6.3. The upload endpoint accepts files without a type check, and the record says a public exploit exists. Upgrade to 1.3.3-beta and configure the allowlist.
What's affected
sz-boot-parent up to and including 1.3.2-beta. The affected spot is the file upload endpoint at /api/admin/sys-file/upload.
The fix is version 1.3.3-beta, which adds an allowlist of file extensions and MIME types for uploads. The release notes tell users to update the oss.yml configuration with two new options, oss.allowedExts and oss.allowedMimeTypes.
The same release includes other hardening changes, among them path validation on template downloads and a protocol restriction on file downloads.
How to check if you're exposed
Check the version of sz-boot-parent in your build files, for example in your Maven configuration or the release you deployed. Anything up to 1.3.2-beta is affected.
After upgrading, open oss.yml and confirm the allowedExts and allowedMimeTypes options are set to the types you really need. An empty or missing list may not give the protection you expect, so read the upgrade guide linked from the release notes.
Also look at your upload storage. Files with executable or script extensions that you did not put there are a sign to investigate.
What to do now
- Upgrade sz-boot-parent to 1.3.3-beta or later.
- Set oss.allowedExts and oss.allowedMimeTypes in oss.yml to a short list of the types your application needs.
- Review stored uploads for unexpected script or executable files and remove them.
- Serve uploaded files from a location that cannot run code, ideally a separate storage domain.
- Restrict the admin API to authenticated and trusted users.
Why it matters
The record lists CWE-434, unrestricted upload of a file with a dangerous type, and CWE-284, improper access control. An upload endpoint that accepts any file type lets a user place content on the server that the application never meant to host, such as scripts.
The score is moderate because the weakness sits behind an admin API route, which may require a login in your setup. The record states the exploit is public, which raises the odds that someone tries it against an exposed instance. It does not say the flaw is exploited in the wild, and the record does not flag it as listed in CISA's Known Exploited Vulnerabilities catalog.
An allowlist is the right fix for upload handling, because blocking known bad types always misses something.
Quick check
Is upgrading enough?
Upgrade and also set the new allowlist options, as the release notes say. Review existing uploads too.
Why a moderate score for an upload bug?
The affected route is part of an admin API. Impact depends on who can reach it and whether it needs a login.
Sources
Last reviewed: 19 October 2026.
