CVE-2026-10239

JeecgBoot edit WordUtil.addImage server-side request forgery

CVSS 5.3 MEDIUMEPSS 0.3%CWE-918

A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. A fix is planned for the upcoming release.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

n/a · JeecgBoot

public PoCs found — 1

cve_referencegithub.com/jeecgboot/JeecgBoot/issues/9610unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/jeecgboot/JeecgBoot/https://github.com/jeecgboot/JeecgBoot/issues/9610 https://vuldb.com/cve/CVE-2026-10239 https://vuldb.com/submit/823266 https://vuldb.com/vuln/367517 https://vuldb.com/vuln/367517/cti