The flaw is in the uploadImgByHttp endpoint of JeecgBoot 3.9.0. By manipulating the fileUrl argument an attacker can cause the server to fetch arbitrary URLs, enabling SSRF. Remote attackers can use the exported parameter to reach internal services or perform data exfiltration. The vulnerability is a CWE‑918 weakness and does not require elevated privileges—once the server is tricked into making the request, the attacker gains the ability to fetch any network resource from the server’s point of view.

JeecgBoot 3.9.0 deployments. The vulnerability affects the /sys/common/uploadImgByHttp functionality and any installations that include this file. The product is JeecgBoot as listed by the CNA.

The CVSS v3.1 score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. However, the flaw is publicly disclosed and not currently listed in the CISA KEV catalog. The endpoint can be reached remotely and no authentication is explicitly mentioned, which allows an attacker to craft a malicious fileUrl from the outside, making the attack surface straightforward for an external adversary.