CVE-2026-7605

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMultipartFile/HttpFileToMultipartFileUtil.downloadImageData of the file CommonController.java of the component uploadImgByHttpEndpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading the affected component is recommended. The vendor confirmed the issue and will provide a fix in the upcoming release.

• CWE-918

• https://github.com/jeecgboot/JeecgBoot/
• https://github.com/jeecgboot/JeecgBoot/issues/9555
• https://github.com/jeecgboot/JeecgBoot/issues/9555#issuecomment-4251745271
• https://vuldb.com/submit/805709
• https://vuldb.com/vuln/360562
• https://vuldb.com/vuln/360562/cti

Published

May 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76044Race condition in USB in Google Chrome prior to 151.0.7922.1…8.3
• CVE-2026-76045Use after free in WebGL in Google Chrome prior to 151.0.7922…8.8
• CVE-2026-76046Buffer overflow in ANGLE in Google Chrome on on Android prio…8.3
• CVE-2026-76047Type confusion in V8 in Google Chrome prior to 151.0.7922.16…8.8
• CVE-2026-76048A flaw has been found in SourceCodester Simple Online Food O…7.3
• CVE-2026-76049A vulnerability has been found in SourceCodester Simple Onli…7.3
• CVE-2026-76050A vulnerability was found in SourceCodester Simple Online Fo…7.3
• CVE-2026-76053The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-76054Invocation of Process Using Visible Sensitive Information in…7.1
• CVE-2026-76055Improper Neutralization of Special Elements used in an OS Co…7.5
• CVE-2026-76057The AutomatorWP – Automator plugin for no-code automations, …4.3
• CVE-2026-76059IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could …8.8