CVE-2026-7603: Server-Side Request Forgery in JeecgBoot
A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of the component LoadFile Endpoint. This manipulation of the argument files causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirmed the issue and will provide a fix in the upcoming release.
AI Analysis
Technical Summary
JeecgBoot versions 3.9.0 and 3.9.1 contain a server-side request forgery vulnerability in the checkPathTraversalBatch function of FileDownloadUtils.java, part of the LoadFile Endpoint. This vulnerability allows remote attackers to manipulate the files argument to trigger SSRF, potentially causing the server to make unauthorized requests. The vendor has acknowledged the issue and intends to provide a fix in an upcoming release. Currently, no patch or official remediation is available.
Potential Impact
Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the affected server, potentially accessing internal resources or services. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low complexity, and no user interaction required. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vendor has confirmed the vulnerability and plans to release an official fix in a future version of JeecgBoot. Until the patch is available, users should consider restricting access to the vulnerable endpoint or implementing network-level controls to limit outbound requests from the server. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-7603: Server-Side Request Forgery in JeecgBoot
Description
A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of the component LoadFile Endpoint. This manipulation of the argument files causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirmed the issue and will provide a fix in the upcoming release.
CVSS v4.0
Score 5.3medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JeecgBoot versions 3.9.0 and 3.9.1 contain a server-side request forgery vulnerability in the checkPathTraversalBatch function of FileDownloadUtils.java, part of the LoadFile Endpoint. This vulnerability allows remote attackers to manipulate the files argument to trigger SSRF, potentially causing the server to make unauthorized requests. The vendor has acknowledged the issue and intends to provide a fix in an upcoming release. Currently, no patch or official remediation is available.
Potential Impact
Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the affected server, potentially accessing internal resources or services. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low complexity, and no user interaction required. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vendor has confirmed the vulnerability and plans to release an official fix in a future version of JeecgBoot. Until the patch is available, users should consider restricting access to the vulnerable endpoint or implementing network-level controls to limit outbound requests from the server. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-01T11:57:52.270Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f589f3cbff5d861095a077
Added to database: 5/2/2026, 5:21:55 AM
Last enriched: 5/10/2026, 2:02:49 AM
Last updated: 6/15/2026, 10:44:11 PM
Views: 111
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.