CVE-2026-8195

MEDIUM

JeecgBoot SVG File CommonController.java cross site scripting

Title source: cna

Description

A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry vdb-entry

VDB-362347 | JeecgBoot SVG File CommonController.java cross site scripting

https://vuldb.com/vuln/362347

Signature, Permissions Required signature permissions-required

VDB-362347 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/362347/cti

Third Party Advisory third-party-advisory

Submit #803528 | jeecgboot JeecgBoot 3.9.1 Doubled Character XSS Manipulations

https://vuldb.com/submit/803528

Exploit exploit

https://github.com/xpp3901/CVE_APPLY/blob/main/V-006_SVG_Stored_XSS/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 8.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (2)

None/JeecgBoot 3.9.0

None/JeecgBoot 3.9.1

Published May 09, 2026

Tracked Since May 10, 2026