JeecgBoot versions 3.9.0 and 3.9.1 contain a server-side request forgery vulnerability in the checkPathTraversalBatch function of FileDownloadUtils.java, part of the LoadFile Endpoint. This vulnerability arises from improper handling of the 'files' argument, enabling remote attackers to cause the server to make unauthorized requests. The vendor has acknowledged the issue and intends to provide a fix in a future release. Currently, no patch or temporary fix is available, and exploitation requires no user interaction and low attack complexity.

Successful exploitation of this vulnerability could allow an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

The vendor has confirmed the vulnerability and stated that a fix will be provided in an upcoming release. Until the official patch is released, no specific mitigation or workaround is documented. Users should monitor the vendor's announcements for the release of the fix and plan to upgrade promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.