JeecgBoot CVE-2026-7605

Exploitation requires valid authenticated credentials (PR:L) - the attacker must either possess legitimate user access or compromise a user account with upload permissions. The vulnerability is triggered when the uploadImgByHttp endpoint is called with a manipulated URL parameter pointing to an attacker-controlled or internal destination. No special configuration or non-default settings are required; the vulnerability exists in the default codebase of affected versions. The exploitation is limited to authenticated users and does not permit unauthenticated remote access, which significantly constrains the attack surface compared to a network-accessible SSRF.

The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a low-severity vulnerability with network accessibility but requiring low-privilege authenticated access, resulting in a 2.1 base score. However, this low score contradicts the practical risk profile: SSRF vulnerabilities are frequently leveraged for reconnaissance, internal service enumeration, and lateral movement, and the E:P tag indicates publicly proven exploitability. The authenticated requirement (PR:L) is a critical limiting factor - the vulnerability requires valid credentials and cannot be exploited anonymously. The low confidentiality/integrity/availability impact scores reflect the 2.1 CVSS rating, though SSRF often enables cascading attacks against internal services not directly reflected in CVSS. Real-world risk depends on deployment context: in environments where user accounts are abundant or compromised, this becomes a lateral movement vector; in restrictive environments with few authenticated users, risk is substantially lower. The combination of public exploit code, vendor acknowledgment, and authenticated-only access means this is a moderate-priority remediation item rather than a critical emergency.

An authenticated user with valid JeecgBoot credentials crafts a request to the uploadImgByHttp endpoint, specifying a URL pointing to an internal service such as 169.254.169.254 (AWS metadata endpoint) or http://localhost:8080/admin. The application fetches the resource without validation and returns the response content or stores it, allowing the attacker to enumerate internal services, extract sensitive metadata, or trigger actions on backend systems.