A stored cross‑site scripting flaw exists in JeecgBoot’s SVG file handler. The vulnerability resides in an unspecified function within CommonController.java and is triggered by uploading or manipulating SVG files. An attacker who can supply a crafted SVG can inject malicious JavaScript that will execute in the browser of any user who subsequently opens the polluted file. The injected code may steal session tokens, deface the interface, or redirect to malicious sites.

JeecgBoot, version 3.9.1 or earlier, specifically the component located at jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java. No other versions are noted as affected, and the vendor has not released a fix for the disclosed flaw.

The CVSS score of 5.3 indicates a moderate impact. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the exploit can be performed over the network without requiring privileged local access, the risk of successful compromise remains moderate, especially if the system is reachable from untrusted environments. No media or social engineering prerequisites are mentioned; thus an attacker can directly target the exposed SVG handling routine.