Submit #888026: https://github.com/jeecgboot JeecgBoot 3.9.2 Cross Site Scripting

JeecgBoot contains a stored Cross-Site Scripting (XSS) vulnerability caused by unauthorized file uploads. Anonymous attackers can directly access the unauthenticated upload interface /airag/chat/upload. The backend file validation allows file formats supporting JavaScript scripts such as SVG and HTML. Uploaded files are persistently stored on the server disk, and the framework’s static resource routing exposes the upload directory to public access, enabling any user to retrieve uploaded files directly.
An attacker may upload an SVG file embedded with malicious JavaScript. When other backend administrators visit the static resource link of this uploaded file, the browser will automatically execute the malicious script under the same origin context. This flaw allows theft of session cookies, account hijacking, and unauthorized invocation of sensitive backend APIs. Exploitation of this vulnerability requires no authentication, posing an extremely high security risk.

• Source: ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9773
• User: 0kam1 (UID 99762)
• Submission: 07/13/2026 17:12 (2 months ago)
• Moderation: 08/29/2026 16:43 (2 months later)
• Status: Duplicate
• VulDB entry: 391454 [JeecgBoot 3.9.2 /airag/chat/upload cross site scripting]
• Points: 0