The flaw resides in the file upload handling routine of JeecgBoot’s CommonController, allowing an attacker to craft a request that forces the server to make an outbound HTTP call to a target of the attacker’s choosing. This server‑side request forgery can be used to reach internal services, exfiltrate data, or pivot into further attacks. The vulnerability is identified as CWE‑918, reflecting the improper validation of user‑controlled HTTP URLs.

JeecgBoot applications running versions up to and including 3.9.1 are affected. No other product versions are listed as impacted, and the vendor labels the issue specifically against the uploadImgByHttpEndpoint component.

The CVSS score of 5.3 indicates a moderate severity. While an EPSS score is not provided, the public release of the exploit suggests that the vulnerability could be used in real‑world attacks. It is not currently listed in the CISA KEV catalog. Because the vulnerability can be triggered from a remote network location without authentication, any exposed instance of the affected JeecgBoot deployment is at risk. Exploitation requires only forming a special HTTP request containing a malicious URL; no privileged host access is needed.