Description

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-17T21:16:47.397Z",
  "pubdate": "2026-08-17T21:16:47.397Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in JeecgBoot version 3.9.2, specifically residing within the file upload endpoint located at /airag/chat/upload. This security flaw enables a remote, network-adjacent or unauthenticated attacker to inject malicious scripts, typically JavaScript, into the application's context. When successfully executed within a victim's browser session, the payload can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the user. The risk implication is high, as it compromises the integrity and confidentiality of user interactions with the vulnerable application. Exploitation requires the attacker to trick a user into interacting with the malicious payload or leveraging the upload vector to store and execute arbitrary client-side code. The vulnerability impacts JeecgBoot v.3.9.2 deployments, presenting significant exposure risks in environments where user-supplied inputs to the chat upload functionality are not adequately sanitized, validated, or contextually escaped before being reflected or rendered in the Document Object Model (DOM).",
  "technicalDetails": "The vulnerability is rooted in the improper handling and insufficient sanitization of input data processed by the /airag/chat/upload endpoint in JeecgBoot version 3.9.2. Specifically, the application fails to adequately neutralize malicious HTML or JavaScript payloads submitted during the file upload or chat interaction process. The vulnerable component involves the server-side ingestion and subsequent client-side rendering pipeline associated with the chat module upload functionality. Attack flow begins when a remote attacker crafts a malicious payload embedded within file metadata, filenames, or request parameters directed at the /airag/chat/upload URI over HTTP/HTTPS protocols. Upon submission, the application improperly processes the input without enforcing strict input validation or output encoding. If the server reflects this unescaped data back to users or stores it in a manner that allows it to be rendered in the browser, the malicious script executes within the security context of the victim's active session. Because XSS operates inside the browser, the payload inherits the privileges of the victim user, potentially granting access to Document object cookies, LocalStorage, SessionStorage, and sensitive DOM elements. Network exposure is broad, as the endpoint is accessible remotely to any entity capable of communicating with the JeecgBoot instance. Depending on the specific configuration of the chat upload feature, authentication requirements may vary, but remote exploitation allows attackers to target users interacting with the application. Post-exploitation impact includes arbitrary code execution in the client browser, session token theft, defacement, and potential pivoting to more advanced client-side attacks against other authenticated users or administrators."
}