CVE-2026-2852: Yeqifu Warehouse

What is CVE-2026-2852?

A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/updateSales/deleteSales of the file dataset\repos\warehouse\src\main\java\com\yeqifu\bus\controller\SalesController.java of the component Sales Endpoint. The manipulation leads to improper access controls. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS6.3 NVD 3.1

SeverityMEDIUM

ExploitationNo exploitation reported

EPSS<1% · P13

Triage statusNo Known Exploit

ActionSchedule for next cycle

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

NVD published2026-02-20

NVD last modified2026-06-17

Timeline

2026-02-20Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

Yeqifu Warehouse

Remediation Steps

Update protobuf.js library to the latest patched version across all JavaScript applications
Review dependency manifests to identify all affected package consumers
Implement Content Security Policy (CSP) to restrict malicious script execution
Audit recent network traffic for suspicious code execution patterns
Run security scanning tools to detect protobuf deserialization attempts in logs

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of April 2026 (April 20 – 26)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.