CVE-2026-2666: 
Java vulnerability analysis and mitigation

CVE-2026-2666 is an unrestricted file upload vulnerability in mingSoft MCMS (Mingfei CMS) version 6.1.1, affecting the Template Archive Handler component at the /ms/file/uploadTemplate.do endpoint. The flaw allows authenticated attackers with high privileges to upload arbitrary files — including malicious JSP webshells — by exploiting a race condition between file decompression and validation. It was disclosed on February 18, 2026, with a proof-of-concept published on GitHub. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Feedly, GitHub PoC).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-434: Unrestricted Upload of File with Dangerous Type; CWE-284: Improper Access Control) in the uploadTemplate.do handler. The application's checkZip method only validates file extensions at the archive boundary and does not inspect file headers; it decompresses the uploaded ZIP archive first, then checks and deletes malicious files — creating a window during which a JSP file with an excessively long filename (to slow deletion) can be accessed and executed by the web server. An attacker crafts a ZIP archive (renamed with a non-standard extension such as .zip2 to bypass initial checks) containing a malicious JSP dropper; once uploaded and decompressed, a concurrent HTTP request accesses the JSP before it is deleted, triggering webshell creation. The attack requires network access and a high-privilege authenticated session (default credentials msopen/msopen are noted in the PoC) (GitHub PoC).

Successful exploitation allows an attacker to plant a persistent JSP webshell (e.g., a Behinder/Godzilla-compatible shell) on the server, achieving remote code execution under the Tomcat service account. This results in full compromise of confidentiality, integrity, and availability of the affected MCMS instance, including the ability to exfiltrate data, install backdoors, pivot to internal network resources, and cause service disruption. The publicly available PoC demonstrates successful Godzilla C2 connection and arbitrary command execution post-exploitation (GitHub PoC, Feedly).

A proof-of-concept exploit was published on GitHub on February 6, 2026, and registered in NVD on February 19, 2026, demonstrating full webshell deployment via the race condition (GitHub PoC). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. No evidence of active in-the-wild exploitation or threat actor attribution has been reported at this time. The EPSS score is approximately 0.035% (0.000350), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify internet-facing MCMS 6.1.1 instances (e.g., via Shodan/Censys searching for /ms-mcms/ paths). Confirm the presence of the template upload endpoint at /ms/file/uploadTemplate.do.
2. Authenticate: Log in to the MCMS admin panel using valid credentials (default: msopen/msopen if unchanged) to obtain an authenticated session.
3. Craft malicious archive: Create a ZIP archive containing a malicious JSP dropper file with an excessively long filename (e.g., aaaabbbccc11111111111111111111111111111111111111111111111111111.jsp) to slow decompression/deletion, plus multiple filler TXT files to further delay processing. The JSP payload, when accessed, writes a Behinder/Godzilla-compatible webshell (shell.jsp) to a web-accessible directory.
4. Rename and upload: Rename the archive with a non-standard extension (e.g., .zip2) to bypass the initial checkZip extension check, then upload it via a POST request to /ms/file/uploadTemplate.do using a tool like Yakit or Burp Suite.
5. Race the deletion: Concurrently run a Python polling script that repeatedly sends GET requests to the extracted JSP path (e.g., http://target:8080/ms-mcms/template/1/1/<longname>.jsp) until a 200 response is received, triggering the dropper JSP before the server deletes it.
6. Access the webshell: Once the dropper executes, it writes shell.jsp to a web-accessible directory (e.g., /2/shell.jsp). Connect using Godzilla or Behinder with the configured password to achieve interactive remote code execution (GitHub PoC).

• Network: Unusual POST requests to /ms/file/uploadTemplate.do with multipart file uploads containing non-standard archive extensions (e.g., .zip2); rapid repeated GET requests to /ms-mcms/template/ paths with excessively long JSP filenames from the same source IP.
• File System: Unexpected JSP files in the template directory (e.g., /ms-mcms/template/1/1/*.jsp) or web root subdirectories (e.g., /2/shell.jsp); presence of Behinder/Godzilla webshell artifacts with AES-encrypted communication patterns.
• Logs: Web server access logs showing HTTP 200 responses to .jsp files in template directories that were not previously present; rapid sequential GET requests to the same long-named JSP path from a single IP.
• Process: Unusual child processes spawned by the Tomcat JVM (e.g., cmd.exe, /bin/bash, curl, wget) following a file upload event (GitHub PoC).

No official vendor patch has been confirmed as of the disclosure date. Recommended immediate mitigations include: (1) restricting access to /ms/file/uploadTemplate.do to trusted administrator IPs only via firewall or reverse proxy ACLs; (2) enforcing strict file upload validation including file header (magic byte) inspection and content-type verification, not just extension checks; (3) making decompression and post-extraction validation atomic (delete-before-extract or validate-before-extract) to eliminate the race window; (4) changing default credentials (msopen/msopen) immediately; and (5) monitoring the template directories for unexpected JSP files. Organizations should check the MCMS Gitee repository for any upstream patches (Feedly, GitHub PoC).

The vulnerability was reported by researchers identified as cds and wcx666 via a public GitHub issue. Red Hat's security advisory page has indexed the CVE, and it has been picked up by aggregators including VulDB, cvefeed.io, INCIBE-CERT, and RedPacket Security. No significant vendor statement from mingSoft or broader media coverage has been identified beyond automated CVE tracking (Feedly).