5.3
Medium
CVE-2026-7605 A security flaw has been discovered in JeecgBoot up to 3.9.1
Description
A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMultipartFile/HttpFileToMultipartFileUtil.downloadImageData of the file CommonController.java of the component uploadImgByHttpEndpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading the affected component is recommended. The vendor confirmed the issue and will provide a fix in the upcoming release.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JeecgBoot 3.9 | 3.9.0 → 3.9.1 | No fix stated |
References
- VDB-360562 | JeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgery vuldb.com
- VDB-360562 | CTI Indicators (IOB, IOC, IOA) vuldb.com
- Submit #805709 | jeecgboot JeecgBoot <= v3.9.1 SSRF vuldb.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of JeecgBoot
The 47 CVEs of JeecgBoot →
CVE-2026-86228
A security vulnerability has been detected in JeecgBoot up to 3.9.3
5.3
Medium
CVE-2026-19000
A vulnerability was identified in JeecgBoot up to 3.9.2
6.9
Medium
CVE-2026-11502
A weakness has been identified in JeecgBoot up to 3.9.2
2.3
Low
CVE-2026-11464
A vulnerability was identified in JeecgBoot up to 3.9.2
2.3
Low