CVE-2026-26682: XJD2020 Fastcms

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component

Affected products

• XJD2020 Fastcms: before 0.1.6 (fixed in 0.1.6)

Published 2026-02-26. Last modified 2026-06-17.