Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for jeewx-boot by jeecgboot

    CVE-2026-82629 (GCVE-0-2026-82629)

    Vulnerability from nvd – Published: 2026-08-31 07:15 – Updated: 2026-08-31 07:15
    VLAI
    Title
    jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload
    Summary
    A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    4.7 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    4.7 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/397127 vdb-entrytechnical-description
    https://vuldb.com/vuln/397127/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-82629 third-party-advisory
    https://vuldb.com/submit/893778 third-party-advisory
    https://github.com/jeecgboot/jeewx-boot/issues/48 exploitissue-tracking
    https://github.com/jeecgboot/jeewx-boot/ product
    Impacted products
    Vendor Product Version
    jeecgboot jeewx-boot Affected: 641ab52c3e1845fec39996d7794c33fb40dad1dd
        cpe:2.3:a:jeecgboot:jeewx-boot:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    CyanM0un (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:jeecgboot:jeewx-boot:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "doUpload Endpoint"
          ],
          "product": "jeewx-boot",
          "vendor": "jeecgboot",
          "versions": [
            {
              "status": "affected",
              "version": "641ab52c3e1845fec39996d7794c33fb40dad1dd"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "CyanM0un (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T07:15:08.902Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397127 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397127"
        },
        {
          "name": "VDB-397127 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397127/cti"
        },
        {
          "name": "CVE-2026-82629 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82629"
        },
        {
          "name": "Submit #893778 | jeecgboot jeewx-boot latest Unrestricted Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893778"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-30T12:07:11.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82629",
    "datePublished": "2026-08-31T07:15:08.902Z",
    "dateReserved": "2026-08-30T10:02:03.893Z",
    "dateUpdated": "2026-08-31T07:15:08.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-12626 (GCVE-0-2025-12626)

    Vulnerability from nvd – Published: 2025-11-03 13:02 – Updated: 2025-11-03 14:08
    VLAI
    Title
    jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal
    Summary
    A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-11-03 14:08 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/?id.330916 vdb-entrytechnical-description
    https://vuldb.com/?ctiid.330916 signaturepermissions-required
    https://vuldb.com/?submit.678926 third-party-advisory
    https://github.com/jeecgboot/jeewx-boot/issues/17 issue-tracking
    https://github.com/jeecgboot/jeewx-boot/issues/47 exploitissue-tracking
    Impacted products
    Vendor Product Version
    jeecgboot jeewx-boot Affected: 641ab52c3e1845fec39996d7794c33fb40dad1dd
    		Create a notification for this product.
    Credits
    fushuling (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12626",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T14:08:03.543674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T14:08:09.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jeecgboot/jeewx-boot/issues/17"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jeecgboot/jeewx-boot/issues/47"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jeewx-boot",
          "vendor": "jeecgboot",
          "versions": [
            {
              "status": "affected",
              "version": "641ab52c3e1845fec39996d7794c33fb40dad1dd"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fushuling (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd gefunden. Hierbei betrifft es die Funktion getImgUrl der Datei WxActGoldeneggsPrizesController.java. Die Ver\u00e4nderung des Parameters imgurl resultiert in path traversal. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Der Exploit wurde der \u00d6ffentlichkeit bekannt gemacht und k\u00f6nnte verwendet werden. Das Produkt nutzt ein Rolling Release f\u00fcr die kontinuierliche Auslieferung. Deshalb gibt es keine Versionsangaben zu betroffenen oder aktualisierten Releases."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-03T13:02:06.078Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-330916 | jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.330916"
        },
        {
          "name": "VDB-330916 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.330916"
        },
        {
          "name": "Submit #678926 | jeecgboot jeewx-boot up to 641ab52 Arbitrary file reading",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.678926"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/17"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/47"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-03T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-03T07:54:35.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12626",
    "datePublished": "2025-11-03T13:02:06.078Z",
    "dateReserved": "2025-11-03T06:49:08.627Z",
    "dateUpdated": "2025-11-03T14:08:09.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-82629 (GCVE-0-2026-82629)

    Vulnerability from cvelistv5 – Published: 2026-08-31 07:15 – Updated: 2026-08-31 07:15
    VLAI
    Title
    jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload
    Summary
    A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    4.7 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    4.7 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/397127 vdb-entrytechnical-description
    https://vuldb.com/vuln/397127/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-82629 third-party-advisory
    https://vuldb.com/submit/893778 third-party-advisory
    https://github.com/jeecgboot/jeewx-boot/issues/48 exploitissue-tracking
    https://github.com/jeecgboot/jeewx-boot/ product
    Impacted products
    Vendor Product Version
    jeecgboot jeewx-boot Affected: 641ab52c3e1845fec39996d7794c33fb40dad1dd
        cpe:2.3:a:jeecgboot:jeewx-boot:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    CyanM0un (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:jeecgboot:jeewx-boot:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "doUpload Endpoint"
          ],
          "product": "jeewx-boot",
          "vendor": "jeecgboot",
          "versions": [
            {
              "status": "affected",
              "version": "641ab52c3e1845fec39996d7794c33fb40dad1dd"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "CyanM0un (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T07:15:08.902Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397127 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397127"
        },
        {
          "name": "VDB-397127 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397127/cti"
        },
        {
          "name": "CVE-2026-82629 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82629"
        },
        {
          "name": "Submit #893778 | jeecgboot jeewx-boot latest Unrestricted Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893778"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-30T12:07:11.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82629",
    "datePublished": "2026-08-31T07:15:08.902Z",
    "dateReserved": "2026-08-30T10:02:03.893Z",
    "dateUpdated": "2026-08-31T07:15:08.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-12626 (GCVE-0-2025-12626)

    Vulnerability from cvelistv5 – Published: 2025-11-03 13:02 – Updated: 2025-11-03 14:08
    VLAI
    Title
    jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal
    Summary
    A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-11-03 14:08 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/?id.330916 vdb-entrytechnical-description
    https://vuldb.com/?ctiid.330916 signaturepermissions-required
    https://vuldb.com/?submit.678926 third-party-advisory
    https://github.com/jeecgboot/jeewx-boot/issues/17 issue-tracking
    https://github.com/jeecgboot/jeewx-boot/issues/47 exploitissue-tracking
    Impacted products
    Vendor Product Version
    jeecgboot jeewx-boot Affected: 641ab52c3e1845fec39996d7794c33fb40dad1dd
    		Create a notification for this product.
    Credits
    fushuling (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12626",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T14:08:03.543674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T14:08:09.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jeecgboot/jeewx-boot/issues/17"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jeecgboot/jeewx-boot/issues/47"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jeewx-boot",
          "vendor": "jeecgboot",
          "versions": [
            {
              "status": "affected",
              "version": "641ab52c3e1845fec39996d7794c33fb40dad1dd"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fushuling (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd gefunden. Hierbei betrifft es die Funktion getImgUrl der Datei WxActGoldeneggsPrizesController.java. Die Ver\u00e4nderung des Parameters imgurl resultiert in path traversal. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Der Exploit wurde der \u00d6ffentlichkeit bekannt gemacht und k\u00f6nnte verwendet werden. Das Produkt nutzt ein Rolling Release f\u00fcr die kontinuierliche Auslieferung. Deshalb gibt es keine Versionsangaben zu betroffenen oder aktualisierten Releases."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-03T13:02:06.078Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-330916 | jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.330916"
        },
        {
          "name": "VDB-330916 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.330916"
        },
        {
          "name": "Submit #678926 | jeecgboot jeewx-boot up to 641ab52 Arbitrary file reading",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.678926"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/17"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/jeecgboot/jeewx-boot/issues/47"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-03T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-03T07:54:35.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12626",
    "datePublished": "2025-11-03T13:02:06.078Z",
    "dateReserved": "2025-11-03T06:49:08.627Z",
    "dateUpdated": "2025-11-03T14:08:09.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}