CVE-2026-19000 is a server-side request forgery vulnerability affecting JeecgBoot versions up to 3.9.2. The flaw resides in an unspecified function in the /airag/chat/send endpoint of the Anonymous Chat Attachment Parser component. An attacker can remotely trigger SSRF, potentially causing unauthorized internal network requests. Exploit code is publicly available, increasing the risk of exploitation. No official patch or fix has been released yet, but a fix is planned for an upcoming version.

Successful exploitation allows an unauthenticated remote attacker to perform server-side request forgery, potentially leading to unauthorized internal network access or information disclosure. The CVSS 3.1 base score is 7.3 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability.

No official fix is currently available. A patch is planned for a future release. Until then, users should monitor vendor advisories for updates and consider applying network-level restrictions or other compensating controls to limit SSRF impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.