A path traversal weakness exists in the Retrieval-Augmented Generation Module of JeecgBoot up to version 3.9.0. The flaw is triggered by manipulating the filePath argument in the /airag/knowledge/doc/edit endpoint, allowing attackers to read or write arbitrary files on the server. Because the input is processed without proper validation, an unauthenticated attacker can exploit the vulnerability remotely, potentially compromising sensitive data or modifying application files.

JeecgBoot applications running version 3.9.0 or earlier, specifically the Retrieval-Augmented Generation component that exposes the /airag/knowledge/doc/edit API. The fault resides in the file handling logic accessed through the filePath parameter.

The CVSS score of 5.3 reflects moderate severity. The EPSS score is below 1%, indicating a low likelihood of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, publicly available exploits exist, and the attack can be carried out remotely via crafted HTTP requests. Because no official fix has been released by the vendor, the risk remains for all installations of the affected versions.