CVE-2026-10239 in JeecgBoot
Summary
by MITRE • 06/01/2026
A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. A fix is planned for the upcoming release.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability identified in JeecgBoot version 3.9.2 and earlier represents a critical server-side request forgery flaw within the WordUtil.addImage function. This vulnerability exists in the file path /airag/word/edit and demonstrates a significant security weakness that allows remote attackers to manipulate the application's behavior. The issue stems from inadequate input validation and sanitization within the document processing functionality, specifically when handling image insertion operations. The vulnerability has been publicly disclosed and is actively being exploited in the wild, making it a pressing concern for organizations utilizing this framework.
The technical implementation of this vulnerability occurs through the WordUtil.addImage function which processes image data during document editing operations. When users upload or manipulate images within the word processing module, the system fails to properly validate external resource references or restrict the protocols that can be used for image retrieval. This allows attackers to craft malicious requests that can cause the application to make unintended network requests to internal systems or external malicious servers. The flaw operates at the application layer where legitimate user requests are processed, making it particularly dangerous as it can be exploited without requiring authentication or elevated privileges. This type of vulnerability maps directly to CWE-918, which specifically addresses server-side request forgery vulnerabilities where applications fail to properly validate and restrict external resource access.
The operational impact of this vulnerability extends beyond simple data exfiltration or service disruption. Attackers can leverage this flaw to perform reconnaissance activities by making requests to internal network services that would normally be restricted from external access. The vulnerability can also facilitate lateral movement within networks, allowing attackers to probe internal systems and potentially escalate privileges through information gathering. Additionally, the remote exploitation capability means that attackers can target vulnerable systems from anywhere on the internet, making this vulnerability particularly dangerous for organizations with exposed web applications. The fact that a fix is planned for an upcoming release indicates that the vendor recognizes the severity of this issue, but organizations must implement immediate mitigations while waiting for the official patch. This vulnerability aligns with ATT&CK technique T1071.004 which covers application layer protocol usage for command and control communications.
Organizations should implement immediate mitigations including network-level restrictions that prevent outbound requests to internal network segments from the affected application servers, input validation controls that sanitize all image URL parameters, and monitoring of unusual outbound network requests. The recommended approach involves implementing a whitelist of allowed image sources and blocking any requests that attempt to access internal resources or use non-standard protocols. Security teams should also deploy intrusion detection systems that can identify patterns consistent with server-side request forgery attempts. Additionally, organizations should conduct thorough vulnerability assessments to identify other potential entry points within their JeecgBoot implementations and consider implementing web application firewalls to provide additional protection layers. The vulnerability highlights the importance of proper input validation and secure coding practices, particularly when handling user-supplied data that may be processed through external resource references.