PT-2026-45350

CVE-2026-10241

Published

2026-06-01

Updated

2026-06-01

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jeecgboot versions prior to 3.9.2

Description A remote server-side request forgery (SSRF) exists in the Cloud Instance Metadata Endpoint component. The issue occurs within the FileDownloadUtils.download2DiskFromNet() function located in the /airag/app/debug file, where improper manipulation of processed URLs allows an attacker to induce the server to make unintended requests.

Recommendations Upgrade to version 3.9.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Ana10Gy

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers