Description

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-31T08:17:03.520Z",
  "pubdate": "2026-08-31T08:17:03.520Z",
  "executiveSummary": "A critical Unrestricted File Upload vulnerability has been identified in the jeecgboot jeewx-boot component. This flaw resides within the doUpload endpoint of the MyJwWebJwid3Controller class.\nThe vulnerability allows remote, unauthenticated, or authenticated attackers to upload arbitrary files to the server, potentially leading to Remote Code Execution (RCE) if the uploaded files can be executed by the web server.\nThe affected component is located in jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java, specifically the doUpload function. All versions up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd are currently considered vulnerable.\nGiven that the project has not responded to the vulnerability report, the risk is elevated. Successful exploitation enables attackers to gain control over the application environment, compromise sensitive data, and pivot within the infrastructure. Users are advised to implement immediate compensating controls to restrict file uploads.",
  "technicalDetails": "The vulnerability is caused by a failure to perform adequate input validation and sanitization on user-supplied files within the doUpload endpoint of the MyJwWebJwid3Controller. The application processes the File argument without verifying the file extension, MIME type, or content, allowing attackers to upload malicious scripts (e.g., JSP, PHP, or other server-side executable formats) directly to the server's filesystem.\nThe attack flow involves an attacker interacting with the doUpload endpoint by crafting a multipart/form-data request. By manipulating the File argument, the attacker can bypass expected application behavior and upload a payload to a directory reachable via the web server. If the server is configured to execute files in the upload directory, the attacker can execute arbitrary code by requesting the uploaded file's URL.\nThe root cause of this issue is improper control of file handling routines. The application likely uses insecure API methods to save the uploaded File object to a static or predictable location without enforcing a 'whitelist' approach to file extensions or utilizing randomized, non-executable filenames.\nThe exploitation method relies on the server's capability to process the uploaded binary data as an executable resource. Because the vulnerability is remotely exploitable, an attacker does not require direct access to the host machine. The lack of an established patch suggests that the vulnerable code logic remains exposed in existing deployments.\nUpon successful exploitation, the post-exploitation impact includes full system compromise. An attacker might achieve Remote Code Execution, which grants the ability to perform reconnaissance, deploy backdoors, exfiltrate the application database, or leverage the compromised host to attack internal network segments. Because no versioning metadata is provided due to the project's rolling release model, organizations must audit their codebases for the specific vulnerable file path: jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java."
}