EUVD-2026-53713
GHSA-wwv2-c3p6-cpr5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no prerequisites; limited C/I/A impact consistent with SSRF without scope change or RCE.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
AnalysisAI
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote attackers a direct path to make the application server issue arbitrary HTTP requests to internal or external network resources. All versions up to and including 3.9.2 are affected, with the flaw residing in the Anonymous Chat Attachment Parser component - meaning no login is required to trigger it. Public exploit code exists via a GitHub issue (no public exploit identified as actively exploited per CISA KEV), and no vendor-released patch is available at time of analysis.
Technical ContextAI
JeecgBoot is a Java-based open-source low-code development platform with an integrated AI RAG (Retrieval-Augmented Generation) chat module. The vulnerable code path is the Anonymous Chat Attachment Parser invoked at the /airag/chat/send endpoint, which processes user-supplied attachment data without adequate URL validation or allowlisting. CWE-918 (Server-Side Request Forgery) identifies the root cause: the server blindly fetches attacker-controlled URLs during attachment processing, turning the application server into a proxy. The CPE cpe:2.3:a:n/a:jeecgboot:*:*:*:*:*:*:*:* covers all tracked versions. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms the endpoint is reachable over the network without authentication or any preconditions, and E:P confirms proof-of-concept code is publicly available.
RemediationAI
No vendor-released patch has been identified at time of analysis; the JeecgBoot project has indicated a fix is planned for an upcoming release. Monitor the official repository at https://github.com/jeecgboot/JeecgBoot/ and the GitHub issue https://github.com/jeecgboot/JeecgBoot/issues/9672 for patch availability and apply the fix immediately upon release. As a primary compensating control, restrict or disable public access to the /airag/chat/send endpoint via WAF rules, reverse proxy ACLs, or firewall policy if the AI RAG anonymous chat feature is not operationally required - this eliminates the attack surface entirely with no impact on other platform features. If the feature must remain accessible, implement strict server-side egress filtering to block outbound requests to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata endpoints (169.254.169.254) - note this limits SSRF to external targets only and does not remediate the root cause. Track VulDB entry https://vuldb.com/vuln/386382 and https://vuldb.com/cve/CVE-2026-19000 for upstream patch confirmation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today