VULNpocalypse
HighVulnerabilityPatch available

Electronic delivery item Inspection Support System flaw disclosed by JVN

JVN reports a file permission flaw in the MLIT Electronic delivery item Inspection Support System 4.0.36 and earlier, update to the latest version.

Published
Fixed in
Latest version and latest installer from the developer, specific version number not confirmed
Exploitation
No, JVN does not report any exploitation and none is confirmed

Live scores

CVE-2026-113345
EPSS
0.001
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to JVN, the Electronic delivery item Inspection Support System contains an improper file access permission vulnerability. JVN says the software is provided by Japan’s Ministry of Land, Infrastructure, Transport and Tourism (MLIT). JVN, which is run by JPCERT/CC and IPA, published advisory JVN#75668103 on 2026-10-26.

JVN classifies the issue as incorrect default permissions (CWE-276) and tracks it as CVE-2026-113345. JVN gives these scores:

  • CVSS 4.0 base score 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  • CVSS 3.0 base score 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

JVN says files in the application’s installation folder may be tampered with, which can result in arbitrary code execution. Both vectors published by JVN describe a local attack that requires low privileges.

JVN credits RyotaK of GMO Flatt Security Inc. with reporting the issue to the developer and coordinating it. According to JVN, RyotaK then reported the case to IPA and JPCERT/CC so users could be notified of the solution through JVN.

These points are not confirmed:

  • Whether the flaw has been exploited. JVN does not mention exploitation.
  • The exact fixed version number. JVN refers only to “the latest version.”

The CVE.org record gathered for this story contained no further details.

Am I affected?

According to JVN, the affected product is Electronic delivery item Inspection Support System Ver.4.0.36 and earlier. If you run one of those versions, you are affected.

What to do now

  1. Check which version of Electronic delivery item Inspection Support System is installed on each machine.
  2. If it is Ver.4.0.36 or earlier, update to the latest version provided by the developer, as JVN advises.
  3. For new installations, use the latest installer provided by the developer, as JVN advises.
  4. Read the developer’s own notice for details. JVN lists the MLIT “Port Continuous Acquisition and Life-cycle Support” page (in Japanese) as the vendor reference.

Sources