A weakness exists in the importDocumentFromZip endpoint of JeecgBoot 3.9.1’s Retrieval‑Augmented Generation component. The flaw allows data that is deserialized by the server without sufficient validation, which could enable unintended behavior. The description notes that the vulnerability can be triggered remotely but requires highly complex manipulation, making successful exploitation difficult.

JeecgBoot version 3.9.1, specifically the Retrieval‑Augmented Generation component’s AiragKnowledgeController importDocumentFromZip endpoint used for processing ZIP file uploads.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. While the attack vector is remote, the required skill and effort described in the advisory reduce the likelihood of real‑world exploitation.