CVE-2026-2111
Path Traversal in JeecgBoot Retrieval-Augmented Generation Module
Publication date: 2026-02-07
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jeecg | jeecg_boot | to 3.9.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2111 is a path traversal vulnerability found in JeecgBoot versions up to 3.9.0, specifically in the Retrieval-Augmented Generation module within the file /airag/knowledge/doc/edit.
The vulnerability arises from improper handling of the filePath argument, which allows an attacker to manipulate the pathname input to traverse outside the intended restricted directory.
This improper input validation enables remote attackers to access arbitrary local files outside the web root directory, potentially exposing sensitive information.
The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is exploitable remotely without authentication.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information by allowing attackers to read arbitrary files on the affected system.
Because the attacker can remotely exploit this issue without authentication, it increases the risk of data exposure and confidentiality breaches.
The exploit is publicly available and considered easy to execute, which raises the likelihood of attacks.
No known mitigations or patches have been provided by the vendor, so affected systems remain vulnerable unless the component is replaced or other protective measures are implemented.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the affected endpoint for path traversal attempts, specifically targeting the /airag/knowledge/doc/edit file in JeecgBoot versions up to 3.9.0.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves manipulation of the filePath argument to traverse directories, detection can involve sending crafted requests with directory traversal sequences such as "../" in the filePath parameter and observing if unauthorized files outside the intended directory are accessed.'}, {'type': 'paragraph', 'content': 'Example commands using curl to test the vulnerability might include:'}, {'type': 'list_item', 'content': 'curl -X POST "http://target-server/airag/knowledge/doc/edit" -d \'{"filePath":"../../../../etc/passwd"}\' -H "Content-Type: application/json"'}, {'type': 'list_item', 'content': 'curl -X POST "http://target-server/airag/knowledge/doc/edit" -d \'{"filePath":"..%2F..%2F..%2F..%2Fetc%2Fpasswd"}\' -H "Content-Type: application/json"'}, {'type': 'paragraph', 'content': 'Monitoring network traffic for suspicious requests containing directory traversal patterns in the filePath parameter can also help detect exploitation attempts.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting or disabling access to the vulnerable /airag/knowledge/doc/edit endpoint if possible.'}, {'type': 'paragraph', 'content': 'Since no official fixes or mitigations have been provided by the vendor, consider the following actions:'}, {'type': 'list_item', 'content': 'Implement web application firewall (WAF) rules to block requests containing directory traversal sequences such as "../" in the filePath parameter.'}, {'type': 'list_item', 'content': 'Restrict access to the affected module to trusted users or internal networks only.'}, {'type': 'list_item', 'content': 'Monitor logs for suspicious activity targeting the vulnerable endpoint.'}, {'type': 'list_item', 'content': 'Consider replacing the affected JeecgBoot component with an alternative product that is not vulnerable.'}] [1]