CVE-2026-10239 is a server-side request forgery vulnerability in JeecgBoot versions 3.9.0 through 3.9.2. The issue exists in the WordUtil.addImage function within the /airag/word/edit file, allowing remote attackers to cause the server to send crafted requests to arbitrary destinations. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. Although a public exploit exists, no active exploitation has been confirmed. No official patch or remediation is currently available, but a fix is planned for an upcoming release.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the JeecgBoot server send unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. The impact is rated medium severity based on the CVSS score and the nature of SSRF risks. There is no evidence of active exploitation in the wild at this time.

A fix for this vulnerability is planned for a future release of JeecgBoot but is not yet available. Users should monitor official vendor channels for the release of the patch and apply it promptly once available. Until then, consider restricting network access from the affected server to sensitive internal resources as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.