CVE-2026-67926

Deferred Deferred - Pending Action

Remote Code Execution in JeecgBoot AI Chat Module

Publication date: 2026-08-17

Last updated on: 2026-08-31

Assigner: MITRE

Description

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-31

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-05

NVD

CVE-2026-67926

EUVD

EUVD-2026-60445

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	jeecgboot	3.9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is in JeecgBoot version 3.9.2, specifically in the AI Chat Module. It allows a remote attacker to execute arbitrary code by manipulating the 'files' parameter. This is a server-side issue that could lead to unauthorized code execution on the affected system.

Detection Guidance

This vulnerability involves arbitrary code execution via the files parameter in JeecgBoot AI Chat Module. To detect it, inspect network traffic for suspicious requests targeting the JeecgBoot AI Chat Module, particularly those including file uploads or parameter manipulation. Check server logs for unusual file operations or unexpected command executions.

Impact Analysis

If you are using JeecgBoot 3.9.2 with the AI Chat Module exposed to the internet, an attacker could exploit this to run malicious code on your server. This could lead to data theft, system compromise, or further network infiltration depending on the attacker's goals.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. Without additional context on data exposure or processing, its compliance impact cannot be determined.

Mitigation Strategies

Immediately update JeecgBoot to the latest version to patch the vulnerability in the AI Chat Module. Disable the JeecgBoot AI Chat Module if an update is not immediately available. Monitor network traffic for unusual activity related to the files parameter in the module.

Hi! I’m here to help you understand CVE-2026-67926. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70