CVE-2026-7605

mediumPriorität · verfolgen · 0EPSS 0.002 · 12. PerzentilEU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (12th) EPSS

CVSS 6.5 · medium

Is it mine?

2 products

Prüfe deine Angriffsfläche

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · bewertet 2026-10-28

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMultipartFile/HttpFileToMultipartFileUtil.downloadImageData of the file CommonController.java of the component uploadImgByHttpEndpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading the affected component is recommended. The vendor confirmed the issue and will provide a fix in the upcoming release.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.3–6.5

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Psecondary · cna@vuldb.comAusnutzbarkeit 8 · Auswirkung 6.4

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · cna@vuldb.comAusnutzbarkeit 2.8 · Auswirkung 3.4

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:Psecondary · ENISA EU

v4.02.1lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@vuldb.com

v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)