CVE-2026-7603: JeecgBoot SSRF Vulnerability

CVE-2026-7603 Overview

CVE-2026-7603 is a Server-Side Request Forgery (SSRF) vulnerability affecting JeecgBoot versions up to 3.9.1. The flaw resides in the checkPathTraversalBatch function within the FileDownloadUtils.java file of the LoadFile Endpoint component. Attackers can manipulate the files argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is remotely exploitable and requires only low-privileged authentication. The exploit details have been publicly disclosed, and the vendor confirmed the issue and committed to providing a fix in an upcoming release. The weakness is classified under CWE-918.

Critical Impact

Authenticated remote attackers can leverage the LoadFile Endpoint to send crafted HTTP requests to internal systems, potentially exposing internal services, metadata endpoints, or trusted-network resources.

Affected Products

• JeecgBoot versions up to and including 3.9.1
• Component: LoadFile Endpoint (FileDownloadUtils.java)
• Function: checkPathTraversalBatch

Discovery Timeline

• 2026-05-02 - CVE-2026-7603 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7603

Vulnerability Analysis

The vulnerability stems from improper validation of user-controlled input in the checkPathTraversalBatch function inside FileDownloadUtils.java. The function processes the files argument supplied to the LoadFile Endpoint without sufficiently restricting destination URLs. As a result, the server can be coerced into issuing outbound HTTP requests on behalf of an attacker.

Server-Side Request Forgery enables attackers to interact with resources reachable by the application server but not directly accessible from the public internet. In typical SSRF scenarios, attackers target internal services, cloud metadata endpoints, and management interfaces that trust requests originating from the local network.

Because JeecgBoot is a low-code development platform commonly deployed in enterprise back-office environments, the LoadFile Endpoint often runs with network access to databases, internal APIs, and cloud provider metadata services. Successful exploitation allows reconnaissance of internal infrastructure and may expose sensitive tokens or credentials.

Root Cause

The root cause is missing or inadequate URL validation in the file-loading logic. The checkPathTraversalBatch routine focuses on path traversal checks but does not enforce a strict allow-list of destinations or block requests to internal IP ranges and metadata services. This logic gap allows the files parameter to specify URLs that the server will fetch.

Attack Vector

The attack is conducted remotely over the network. An authenticated attacker with low privileges submits a crafted request to the LoadFile Endpoint, supplying the files parameter with a URL pointing to an internal or external target. The server processes the request and issues the outbound HTTP call, returning data or side-effects to the attacker. Refer to the GitHub Issue Tracker for technical details on the disclosed exploit path.

Detection Methods for CVE-2026-7603

Indicators of Compromise

• Unexpected outbound HTTP requests originating from JeecgBoot application servers, especially to RFC1918 ranges, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
• Application logs showing requests to the LoadFile Endpoint with files parameters containing absolute URLs or unusual schemes.
• Authentication events from low-privileged accounts immediately preceding anomalous outbound traffic from the server.

Detection Strategies

• Inspect HTTP request logs for the LoadFile Endpoint and flag requests where the files argument contains http://, https://, file://, or gopher:// schemes.
• Correlate web application access logs with egress firewall logs to identify server-initiated requests that follow user-supplied input.
• Deploy web application firewall rules that block requests to LoadFile parameters referencing internal IP ranges or cloud metadata hostnames.

Monitoring Recommendations

• Monitor egress traffic from JeecgBoot servers and alert on connections to internal management subnets or instance metadata services.
• Track usage patterns of the LoadFile Endpoint and baseline normal behavior to surface anomalies.
• Review the VulDB #360560 entry for updated threat intelligence and exploit indicators.

How to Mitigate CVE-2026-7603

Immediate Actions Required

• Restrict access to the JeecgBoot LoadFile Endpoint to trusted users and networks until a vendor patch is available.
• Deploy egress filtering on application servers to block outbound traffic to internal subnets, loopback addresses, and cloud metadata endpoints.
• Audit recent LoadFile Endpoint requests for suspicious files parameter values and review affected accounts.

Patch Information

The vendor confirmed the vulnerability and indicated that a fix will be included in an upcoming release. Track the JeecgBoot GitHub repository and the vendor response on issue 9553 for patch availability. Upgrade to the fixed version once published.

Workarounds

• Place a reverse proxy or web application firewall in front of JeecgBoot to validate the files parameter and reject absolute URLs.
• Apply network-level controls that prevent the application server from reaching internal management interfaces, databases, or metadata services that are not required for normal operation.
• Reduce the privileges of accounts that can reach the LoadFile Endpoint, limiting the population of users able to trigger the vulnerable code path.