CVE-2026-82629
Received Received - Intake

Unrestricted File Upload in Jeecgboot Jeewx-Boot

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82629
EUVD
EUVD-2026-68389

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jeecgboot jeewx_boot to 641ab52c3e1845fec39996d7794c33fb40dad1dd (inc)
jeecgboot jeewx-boot to 641ab52c3e1845fec39996d7794c33fb40dad1dd (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload issue in the jeewx-boot project. The affected component is the MyJwWebJwid3Controller class, specifically the doUpload method. Attackers can exploit this by uploading files with dangerous extensions to the POST /commonweixin/back/myJwWebJwid3/doUpload endpoint. The issue occurs because the code extracts the file extension from the attacker-controlled filename without validation and writes the uploaded bytes directly to disk without verifying the file content.

Detection Guidance

Check for suspicious file uploads to the endpoint POST /commonweixin/back/myJwWebJwid3/doUpload. Monitor for files with dangerous extensions like .jsp, .jspx, or .war. Review server logs for multipart POST requests with manipulated filenames or Content-Type headers.

Impact Analysis

An authenticated attacker could upload malicious files, such as a JSP shell, to the server. This could lead to remote code execution, allowing the attacker to take control of the server, steal data, or perform other malicious activities. The impact includes potential data breaches, system compromise, and unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health data. Non-compliance with these regulations can result in legal penalties, fines, and reputational damage. Organizations must address this vulnerability to maintain compliance and protect sensitive data.

Mitigation Strategies

Implement strict file extension allowlists, normalize extensions to lowercase, reject filenames without extensions, verify file content using magic bytes, and block requests to the vulnerable endpoint until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart