EUVD-2026-28939Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in JeecgBoot up to version 3.9.1 allows remote attackers to inject malicious scripts via SVG file handling in the CommonController component, requiring user interaction to trigger payload execution. The vulnerability has publicly available exploit code and affects the system's integrity through stored script injection, with a CVSS score of 2.1 reflecting low severity due to user interaction requirement and limited impact scope.
Technical ContextAI
The vulnerability exists in JeecgBoot's SVG file handler within the CommonController.java component of the jeecg-module-system module. JeecgBoot is a Java-based rapid development platform for enterprise applications built on Spring Boot. The root cause is improper input validation and output encoding of SVG file content (CWE-79: Improper Neutralization of Input During Web Page Generation). SVG files, while intended as vector graphics, can contain embedded JavaScript or event handlers that execute in browser contexts when processed without proper sanitization. The CommonController likely processes SVG uploads or file operations without adequate XSS protections, allowing attackers to embed malicious scripts within SVG payloads that persist in the application and execute when viewed by users.
RemediationAI
Upgrade JeecgBoot to a patched version beyond 3.9.1 when available from the vendor. If immediate patching is not possible, implement compensating controls: (1) Disable or restrict SVG file uploads in the CommonController until a patch is deployed-this eliminates the attack vector but may break legitimate SVG functionality; (2) Implement strict Content Security Policy (CSP) headers with script-src 'self' to prevent execution of injected scripts, noting this requires careful configuration to avoid breaking legitimate scripts; (3) Apply input validation to reject SVG files containing script tags, event handlers (onclick, onerror, onload), or <script> elements-this requires a dedicated SVG sanitization library like DOMPurify or OWASP Java HTML Sanitizer integrated into the upload handler; (4) Ensure all user-uploaded SVG content is served with MIME type image/svg+xml and X-Content-Type-Options: nosniff headers to prevent browser interpretation as HTML. Monitor the GitHub repository referenced in disclosures (github.com/xpp3901/CVE_APPLY) and vendor channels for patch releases, as the vendor's non-response suggests updates may appear without formal security advisory.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today