A command injection flaw in Jeecg Boot's /jmreport/show endpoint allows attackers to execute arbitrary code on the server. The weakness, classified as CWE‑77, means that specially crafted HTTP requests can insert shell commands into the server’s execution context, enabling full control over the affected host. This elevates the threat to complete compromise of confidentiality, integrity, and availability of the compromised system.

The vulnerability is present in Jeecg Boot versions 3.0.0 through 3.5.3, including the open‑source distribution. Any instance of Jeecg Boot running within that version range that exposes the /jmreport/show URI to the internet or an untrusted network is susceptible to exploitation.

With a CVSS score of 9.8 the risk is critical. The EPSS score below 1% suggests currently low measured exploitation probability, but the lack of a current KEV listing does not reduce the impact. Attackers would need to send a crafted HTTP request to /jmreport/show to trigger the injection; no user interaction beyond reaching the endpoint is required. Given the remote nature of the vector, any exposed or unattended deployment is at high risk.