A flaw in jeecgboot:jeewx-boot allows an attacker to upload arbitrary files through the doUpload endpoint without any validation. The attacker can supply any file type via the File argument, which the application accepts and stores on the server. If a malicious script or executable is uploaded, it could be executed, leading to remote code execution or unauthorized access, representing CWE‑284 and CWE‑434 weaknesses.

The vulnerability exists in jeecgboot:jeewx-boot up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd. Because the project uses a rolling‑release model, exact version numbers are not published; any instance built before the fix is considered vulnerable. The affected component is the MyJwWebJwid3Controller.doUpload method in the weixin module.

The CVSS score of 5.1 indicates a medium severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, so the exploitation probability is uncertain. However, unrestricted upload is a common attack vector; the exploit has been publicly disclosed and could be leveraged remotely if the endpoint is accessible, making this a moderate‑risk vulnerability that should be remediated promptly.