{"id":"CVE-2026-113345","kind":"vulnerability","aliases":["CVE-2026-113345"],"related":[],"title":"Japan MLIT inspection system: file tampering enables arbitrary code execution","description":"Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.","summary":"The Electronic delivery item Inspection Support System from Japan's Ministry of Land, Infrastructure, Transport and Tourism has improper file access permissions on its installation folder. A user or attacker who can write to those files can modify them and run arbitrary code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["japan-government","other","windows"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T05:17:54+00:00","first_seen_at":"2026-10-26T05:28:34+00:00","triaged_at":"2026-10-26T05:29:08+00:00","updated_at":"2026-10-26T05:29:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T05:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Japan MLIT inspection system: file tampering enables arbitrary code execution","impact":"high","summary":"The Electronic delivery item Inspection Support System from Japan's Ministry of Land, Infrastructure, Transport and Tourism has improper file access permissions on its installation folder. A user or attacker who can write to those files can modify them and run arbitrary code.","category":"other","nicknames":[],"who_cares":["windows","japan-government"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code after tampering with application files.","analyst_note":"Check the NVD entry and JVN advisory for the affected versions, the required local access level, and the vendor's fixed release.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":3311,"output_tokens":349,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113345':13A,16A '-2026':12A,15A 'access':42B,86C 'applic':96C 'arbitrari':8A,63B,103C 'attack':51B 'code':9A,64B,104C 'contain':82C 'cve':11A,14A 'deliveri':24B,66C 'electron':23B,65C 'enabl':7A 'execut':10A,105C 'file':5A,41B,57B,85C,89C 'folder':47B,93C 'govern':19B 'improp':40B,84C 'infrastructur':35B,78C 'inspect':3A,26B,68C 'instal':46B,92C 'item':25B,67C 'japan':1A,18B,30B,73C 'japan-govern':17B 'land':34B,77C 'may':97C 'ministri':32B,75C 'mlit':2A 'modifi':59B 'permiss':43B,87C 'provid':71C 'result':101C 'run':62B 'support':27B,69C 'system':4A,28B,70C 'tamper':6A,99C 'tourism':38B,81C 'transport':36B,79C 'user':49B 'vulner':88C 'window':21B 'write':54B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T05:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113345","severity":null,"published_at":"2026-10-26T05:17:54+00:00","modified_at":"2026-10-26T05:17:54+00:00","first_seen_at":"2026-10-26T05:28:34+00:00","fetched_at":"2026-10-26T05:28:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}