A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. (CVE-2026-82629)

The vulnerability (CVE-2026-82629) affects the doUpload endpoint in the MyJwWebJwid3Controller.java file of jeecgboot jeewx-boot up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd. It allows an attacker with high privileges to remotely manipulate the File argument to upload files without restriction. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vulnerability is classified under CWE-284 (Improper Access Control). The vulnerability has been publicly disclosed, but the vendor has not yet issued a response or patch. The CVSS v3.1 base score is 4.7, reflecting low severity with network attack vector, low attack complexity, required privileges high, no user interaction, and impacts on confidentiality, integrity, and availability rated low.

An attacker with high privileges can remotely upload arbitrary files without restriction, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability does not require user interaction and can be exploited over the network. However, the requirement for high privileges limits the scope of exploitation. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates. Until a fix is released, restrict access to the vulnerable endpoint to trusted users with high privileges and consider additional access controls or network-level restrictions to limit exposure.