CVE-2026-10241
jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 1, 2026
- Updated
- Jun 1, 2026
- Reserved
- May 31, 2026
Description
A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function FileDownloadUtils.download2DiskFromNet of the file /airag/app/debug of the component Cloud Instance Metadata Endpoint. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.9.2 mitigates this issue. It is suggested to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
The server processes these URLsjeecgboot |
|
References
- VDB-367519 | jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgeryvdb-entrytechnical-description
- VDB-367519 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-10241 | CVE Analysis and Reportthird-party-advisory
- Submit #823268 | jeecgboot JeecgBoot <= v3.9.1 SSRFthird-party-advisory
- https://github.com/jeecgboot/JeecgBoot/issues/9611exploitissue-tracking
- https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.