A flaw in the UEditor component of erzhongxmu JEEWMS 3.7 allows an attacker to manipulate the "upfile" parameter in the getRemoteImage.jsp endpoint, causing the server itself to retrieve arbitrary URLs. This server‑side request forgery can lead to the exploitation of internal network resources, data exfiltration, or denial of service against internal services. The vulnerability can be triggered remotely by supplying a crafted request to the affected endpoint.

The vulnerability is limited to erzhongxmu JEEWMS version 3.7, specifically the /plug‑in/ueditor/jsp/getRemoteImage.jsp functionality of the UEditor module. No other versions or components are listed as affected.

The CVSS v3 score of 6.9 rates this issue as Moderate, with an EPSS probability of less than 1%. It is not listed in the CISA KEV catalog. The attack vector is remote, using an HTTP request to the vulnerable endpoint. Exploitation requires the ability to send arbitrary URLs in the "upfile" parameter, and the attacker benefits from the server’s outbound network connectivity; no local privilege escalation is required, and the scope is confined to the target system’s network resources.