CVE-2026-82629

Name of the Vulnerable Software and Affected Versions jeecgboot jeewx-boot versions up to 641ab52c3e1845fec39996d7794c33fb40dad1dd

Description A remote unrestricted upload issue exists in the doUpload endpoint. The problem resides in the MyJwWebJwid3Controller.doUpload() function within the jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java file. By manipulating the File argument, an attacker can upload files without proper restrictions.

Recommendations As a temporary workaround, restrict access to the doUpload endpoint or avoid using the File argument in the MyJwWebJwid3Controller.doUpload() function until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.