A vulnerability was identified in JeecgBoot up to version 3.9.1 that allows an attacker to manipulate the argument file names within the FileDownloadUtils.java component’s checkPathTraversalBatch method. This manipulation can cause the application to perform privileged HTTP requests on the attacker’s behalf, effectively enabling server‑side request forgery. The impact is that an attacker can cause the server to communicate with internal or external resources, potentially exposing confidential data or aiding further exploitation. The CVE description confirms that the exploit is publicly disclosed and can be initiated remotely.

The affected product is JeecgBoot, with vulnerability present in all releases from the initial release through version 3.9.1. The specific component impacted is the LoadFile Endpoint in FileDownloadUtils.java, which accepts a files argument susceptible to manipulation.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. No EPSS score is provided, and the issue is not listed in the CISA KEV catalog. According to the description, the attack vector is remote and relies on server‑side request forgery, meaning an attacker only needs to send crafted requests to the vulnerable endpoint to trigger the exploit. The vendor has acknowledged the issue and will release a fix in an upcoming update.