CVE-2026-2111

A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the component Retrieval-Augmented Generation Module. Executing a manipulation of the argument filePath can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://vuldb.com/?ctiid.344687Permissions Required, VDB Entry
• https://vuldb.com/?id.344687Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.746789Third Party Advisory, VDB Entry
• https://www.yuque.com/la12138/vxbwk9/ezodz20a26g36y8mExploit, Third Party Advisory

Published

Feb 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21104Heap-based buffer overflow in KnoxVault trustlet prior to SM…6.7
• CVE-2026-21105Improper access control in Collection prior to version 1.0.1…5.5
• CVE-2026-21106Improper verification of intent by broadcast receiver in Sam…5.1
• CVE-2026-21107Out-of-bounds write in Samsung Notes prior to version 4.4.45…5.5
• CVE-2026-21108Improper export of android application components in Bixby T…5.5
• CVE-2026-21109Improper access control in Watch Plugin prior to Android Wat…2.1
• CVE-2026-21110Out-of-bounds write in libsavscmn.so prior to One UI 8.5 all…6.9
• CVE-2026-21111Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allo…6.9
• CVE-2026-21112Improper input validation in Samsung Tips prior to Android 1…5.5
• CVE-2026-21113Improper export of android application components in Visual …5.5
• CVE-2026-2112The Dam Spam plugin for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2026-2113A security vulnerability has been detected in yuan1994 tpadm…9.8