CVE-2026-82629: Unrestricted Upload in jeecgboot jeewx-boot

The vulnerability exists in the doUpload function of the MyJwWebJwid3Controller class within the jeewx-boot module of jeecgboot. An attacker with high privileges can remotely manipulate the File argument to upload files without restriction. This could potentially allow unauthorized file uploads, leading to further compromise. The vulnerability is identified up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd. The project has been notified but has not yet responded or provided a fix. No specific versioning information is available due to the rolling release nature of the product.

The vulnerability allows remote attackers with high privileges to upload arbitrary files without restriction. This can lead to unauthorized file uploads, which may be leveraged for code execution or other malicious activities depending on the environment. The CVSS 4.0 score is 5.1 (medium), reflecting network attack vector, low complexity, no user interaction, but requiring high privileges and having low impact on confidentiality, integrity, and availability.

No official fix or patch is currently available. The vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the doUpload endpoint to trusted users and implementing additional file upload validation or filtering may reduce risk.