Description
There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.
Affected products
jeecg: jeecg boot
References2
- gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0 Third Party Advisory
- pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp Permissions Required
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 46 · as of 12 November 2026
- CWE
- CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.