CVE-2026-111605
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-639
Impact
Authenticated workspace users with SSH file permissions can read, modify, and delete files on SSH hosts belonging to other workspaces. Attackers only need basic workspace access with SSH file permissions to supply foreign SSH asset IDs.
Root cause
SshFileController lacks cross-workspace authorization checks, allowing an insecure direct object reference (IDOR) via arbitrary SSH asset IDs.
Affected systems
Jpom through 2.11.12
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade past 2.11.12 once a patched release is available; in the meantime, revoke SSH file permissions from non-admin workspace users or restrict network access to the Jpom server.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
References
- https://github.com/dromara/Jpom
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/SshFileController.java#L44-L65
- https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-sshfilecontroller