Electronic delivery item Inspection Support System: Improper file access permissions
Summary
The Electronic delivery item Inspection Support System of Japan's Ministry of Land, Infrastructure, Transport and Tourism sets improper file access permissions on its installation folder. A user with low privileges and local access can modify files in that folder, which can lead to arbitrary code execution. Remote exploitation is not indicated, and no known exploitation has been reported.
Affected
- Electronic delivery item Inspection Support System Ver.4.0.36 and earlier
- CVSS 4.0: 8.5 (High), CWE-276
Fixed in
Unknown. The vendor has not published a fixed version number in the sources reviewed; use the latest installer provided by the developer.
Workaround
- No official workaround published.
- Restrict write access on the installation folder to administrators only and check the current ACLs.
Exploitation
- No known exploitation; not listed in CISA KEV.
- No public proof of concept found.
- Attack requires local access and low privileges.
Our recommendation
- Check whether the software is installed and which version is in use.
- Update to the latest vendor build, or remove versions 4.0.36 and earlier.
- Ensure the installation folder is not writable by ordinary users.
- Monitor the installation directory for unexpected file changes.
- Priority is low unless the product is required for Japanese public-works contracts or related clients.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#75668103 (vendor and JPCERT/CC advisory) jvn.jp
- MLIT CALS vendor page (Japanese) www.ysk.nilim.go.jp
- VulDB CVE-2026-113345 vuldb.com
- VulDB vulnerability 426313 vuldb.com
- NVD mirror via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:11.
Original description (NVD)
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.