The flaw resides in the FileDownloadUtils.download2DiskFromNet function within the /airag/app/debug component of JeecgBoot’s Cloud Instance Metadata Endpoint. By manipulating input to this function, an attacker can cause the server to issue arbitrary HTTP requests, resulting in a server‑side request forgery. The vulnerability can be triggered remotely and has publicly available exploit code. A successful exploitation would allow the attacker to instruct the server to contact internal or external resources, potentially exposing sensitive data, enabling further attacks, or executing additional malicious actions.

JeecgBoot applications running versions up to 3.9.1 are affected. The vulnerability exists in the Cloud Instance Metadata Endpoint component handling URLs. Versions 3.9.2 and later contain the fix. Only deployments of the affected component are impacted; other JeecgBoot modules are not listed as vulnerable.

The CVSS score of 5.3 indicates moderate impact. Exploitation is feasible from a remote network, as the flaw does not require local access or privilege escalation. No EPSS value is currently available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation to date. However, publicly available code and remote nature mean it is prudent to apply the upgrade promptly.