Jpom: Cross-workspace authorization bypass in SSH file management
Summary
Jpom through 2.11.12 contains an authorization bypass in the SshFileController. An authenticated user with SSH file permissions in any workspace can supply SSH asset IDs that belong to other workspaces. This allows reading, modifying, uploading and deleting files on SSH hosts of other workspaces. Public proof-of-concept material exists, but no in-the-wild exploitation is known.
Affected
- Jpom through 2.11.12
Fixed in
Unknown.
Workaround
- No vendor workaround known.
- Restrict SSH file permissions to users who need them.
- Review workspace memberships so that users only reach workspaces they need.
- Do not expose Jpom directly to the internet; use a VPN.
Exploitation
- Public proof-of-concept write-up available (CISA SSVC: exploitation poc).
- Not automatable according to CISA SSVC.
- No evidence of in-the-wild exploitation; not listed in CISA KEV.
Our recommendation
- Check whether Jpom is in use and at which version.
- Check whether Jpom is reachable from the internet and move it behind a VPN if it is.
- Review workspace memberships and SSH file permissions.
- Monitor the Jpom GitHub repository for a fixed release and advisory, then patch promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Jpom GitHub repository github.com
- SshFileController.java at v2.11.12 github.com
- HackMD write-up: Jpom SSH file cross-workspace IDOR hackmd.io
- VulnCheck advisory: Jpom cross-workspace authorization bypass www.vulncheck.com
- CVE record JSON (cvelistV5) raw.githubusercontent.com
- Strix CVE-2026-111605 www.strix.ai
- VulDB entry 421371 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:53.
Original description (NVD)
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
NVD references (5)
- https://github.com/dromara/Jpom
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/Ss…
- https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-sshfilecon…
- https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.