PT-2025-44761 · Unknown+1 · Jeecg-Boot+1

Fushuling · Published 2025-11-03 · Updated 2025-11-03 · CVE-2025-12626

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jeecgboot jeewx-boot versions prior to 641ab52c3e1845fec39996d7794c33fb40dad1dd

Description A security flaw exists in jeecgboot jeewx-boot. Manipulation of the imgurl argument in the getImgUrl function within the WxActGoldeneggsPrizesController.java file can lead to path traversal. Remote exploitation is possible, and an exploit has been publicly released. The issue's initial fix can be bypassed with additional encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12626

Affected Products

Jeecg-Boot

Jeewx-Boot

References · 8

• 🔥 https://github.com/jeecgboot/jeewx-boot/issues/17 · Exploit
• 🔥 https://github.com/jeecgboot/jeewx-boot/issues/47 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12626 · Security Note
• https://vuldb.com/?id.330916 · Note
• https://vuldb.com/?submit.678926 · Note
• https://t.me/CVEtracker/36411 · Telegram Post
• https://t.me/cveNotify/141309 · Telegram Post
• https://vuldb.com/?ctiid.330916 · Note