Jili Technology’s Enterprise Cloud Database has an Arbitrary File Read flaw (CVE-2026-87747) that may let privileged remote attackers download
[SUMMARY]Jili Technology’s “Enterprise Cloud Database” has an Arbitrary File Read vulnerability, CVE-2026-87747. It is known to allow a remote attacker with administrative privileges to download arbitrary system files via Relative Path Traversal; the vendor recommends installing the Patch released on or after 2026/7/9.[/SUMMARY]
On 2026-09-09, TWCERT/CC announced “Jili Technology | Enterprise Cloud Database - Arbitrary File Read,” corresponding to TVN-202609003 and CVE-2026-87747, and listed CVSS 6.9 (Medium) and CVSS 4.9 (Medium) scores.[1] The announcement stated that the Enterprise Cloud Database developed by Jili Technology has an Arbitrary File Read vulnerability, and that a remote attacker who has obtained administrative privileges can use Relative Path Traversal to download arbitrary system files.[1]
The core risk of this type of vulnerability is not simply that one file can be read, but that an attacker can gradually reconstruct host structure, service configurations, credential traces, or operational information from system files, thereby expanding the basis for subsequent intrusion planning.[1]
The two key technical terms in this advisory are Arbitrary File Read and Relative Path Traversal.[1] The former means the system has unrestricted file-reading capability, while the latter means an attacker can use path backtracking to escape the intended directory scope and target other system files.[1]
The announcement specifically notes that the attack prerequisite is a remote attacker who has already obtained administrative privileges.[1] This means the exploitation threshold is not a completely unauthenticated external read, but one based on a higher-privilege scenario, making it more like a high-risk amplification point after internal lateral movement or account compromise.[1]
From the CVSS description, TWCERT/CC lists both CVSS:4.0 and CVSS:3.1 vectors, both of which reflect network accessibility, low complexity, required high privileges, no user interaction, and a primary impact on confidentiality rather than direct integrity or availability effects.[1] This pattern usually means the vulnerability may not immediately cause service disruption, but it can lead to sensitive data leakage and the establishment of a subsequent attack chain.[1]
Technically, Relative Path Traversal risks often appear in file download, attachment access, report export, or path-parameter concatenation workflows; if the system lacks strict validation of user input directory structure, separator characters, normalization results, and the actual access path, an attacker may be able to redirect requests to unintended locations.[1] In this case, the announcement clearly states that the result is “downloading arbitrary system files,” so remediation should focus on path validation, access control, and redesigning file access boundaries.[1]
The affected product is “Enterprise Cloud Database,” and the announcement does not distinguish specific sub-versions in the summary, only stating that the product itself is affected.[1] This means that asset inventory should not rely solely on version numbers, but should first confirm whether the product is deployed and then check whether the official patch has been applied.[1]
The CVSS 3.1 vector listed in the announcement is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating that this vulnerability primarily impacts confidentiality and requires the attacker to have high privileges.[1] Therefore, if the system hosts customer data, internal operational data, identity information, or other sensitive information in a corporate environment, the real-world risk will be significantly higher than in a typical test environment.[1]
In addition, because this type of vulnerability allows attackers to read system files, any configuration files, log files, connection strings, backup indexes, or process information stored on the host may become clues for follow-up attacks.[1] From a security governance perspective, this means data classification, minimal host exposure, and log de-sensitization are also important defensive lines.[1]
The official remediation is very clear: install the Patch released on or after 2026/7/9.[1] For organizations, patching should take priority over routine feature updates, especially for hosts that provide external services or are deployed in high-privilege management networks.[1]
Before patching, immediately inventory whether this product exists, confirm whether the management interface is exposed and accessible, and check for abnormal file access or suspicious administrative activity.[1] If the system has download, export, or attachment-reading functions, the exposure surface should also be temporarily reduced to prevent further abuse.[1]
At the same time, it is recommended to separate administrative privileges from general user privileges so that a single administrative account cannot directly access highly sensitive file paths.[1] If the environment permits, restrict the sources that can access the management interface, enforce the principle of least privilege, and establish a whitelist mechanism for readable paths to reduce the likelihood of the same type of vulnerability recurring.[1]
If exploitation is suspected, preserve the relevant logs and audit records first, including administrative login records, file access records, and abnormal download events, as the basis for incident investigation.[1] For system files that may already have been exposed, assess whether credentials, configuration files, or sensitive data have leaked, and perform password rotation and access credential updates simultaneously.[1]
5-Step Remediation Checklist