CVE-2026-2555

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Improper Input Validation pada jeecg boot. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization. The attack can be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

16 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jeecgboot/JeecgBoot/issues/9335 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.346163 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.750232 advisory pihak ketiga · vdb entry
• https://github.com/jeecgboot/JeecgBoot/ product
• https://vuldb.com/?ctiid.346163 permissions required · vdb entry