Threats tagged 'ghsa-vxx8-4p2v-5g5j'

A server-side request forgery (SSRF) vulnerability exists in JeecgBoot up to version 3.9.1 within the checkPathTraversalBatch function of the FileDownloadUtils.java file in the LoadFile Endpoint component. This vulnerability allows remote attackers to manipulate the 'files' argument to initiate SSRF attacks. The vendor has confirmed the issue and plans to release a fix in an upcoming version. The vulnerability has been publicly disclosed and exploit code is available, but no active exploitation in the wild has been reported.