CVE-2026-82629: jeecgboot jeewx-boot Improper Access Control

Vulnerability summary

CVE-2026-82629 is a medium (CVSS 5.8) Improper Access Control vulnerability in jeecgboot jeewx-boot. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-08-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.