CVE-2026-8195
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
JeecgBoot up to version 3.9.1 contains a Cross-Site Scripting vulnerability in the SVG file handler component. An unknown function in CommonController.java allows remote script injection. The exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session hijacking, data theft, or other attacks.
Recommendation
Immediately update JeecgBoot to a version above 3.9.1 and apply the relevant security patches. Also restrict access to SVG file upload functionality.
Original NVD description (English source)
A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.