JVN#75668103
Improper file access permission vulnerability in Electronic delivery item Inspection Support System
Overview
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability.
Products Affected
- Electronic delivery item Inspection Support System Ver.4.0.36 and earlier
Description
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains the following vulnerability:
- Incorrect default permissions (CWE-276)
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
- CVE-2026-113345
Impact
Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Solution
Update the Software
Users who have already installed the affected application should update to the latest version.
Use the latest installer
Users installing the application should use the latest installer provided by the developer.
For more details, refer to the information provided by the developer.
Vendor Status
| Vendor | Link |
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Port Continuous Acquisition and Life-cycle Support (Text in Japanese) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Credit
RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and coordinated. After the coordination was completed, RyotaK reported the case to IPA and JPCERT/CC to notify users of the solution through JVN.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2026-113345 |
| JVN iPedia |
|