JeecgBoot versions up to and including 3.9.5 contain a missing authorization flaw in the SysCheckRuleController importExcel endpoint. The flaw allows any authenticated user with low privileges to upload a specially crafted Excel file, bypassing the required system:checkRule:add permission, and to create new validation rules system-wide. This can lead to arbitrary regular expression patterns being added, which may be used to disrupt system behavior or enable further exploitation by affecting data validation across the application.

The vulnerability affects JeecgBoot, an open-source Java-based application framework for building business applications. Affected versions include all releases through 3.9.5, with the flaw present in the SysCheckRuleController module that processes Excel uploads. The exact version number is 3.9.5, but any prior version containing the same code may also be vulnerable.

Based on the CVSS score of 5.3, the vulnerability is considered medium severity, and the EPSS score is not available, so the exploit likelihood cannot be precisely quantified. The flaw is not listed in the CISA KEV catalog, meaning there are no known active exploits at the time of this analysis. Attackers need authenticated access to the application and the ability to upload files, but no elevated privileges are required beyond the standard authenticated user level. By uploading malicious Excel files, an attacker can create numerous complex or malicious regex validation rules that may degrade performance or bypass data validation, thereby potentially causing a denial of service or enabling data integrity violations.