CVE-2026-8195: JeecgBoot SVG Handler XSS Vulnerability

CVE-2026-8195 Overview

CVE-2026-8195 is a stored cross-site scripting (XSS) vulnerability in JeecgBoot versions up to 3.9.1. The flaw resides in an unspecified function within jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java, which handles SVG file uploads. Attackers can craft malicious SVG files containing embedded JavaScript that executes in the browser context of any user who views the file. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated remote attackers can upload SVG files containing malicious scripts that execute in victim browsers, enabling session theft and unauthorized actions within the JeecgBoot application.

Affected Products

• JeecgBoot versions up to and including 3.9.1
• JeecgBoot SVG File Handler component (CommonController.java)
• Web applications built on vulnerable JeecgBoot releases

Discovery Timeline

• 2026-05-09 - CVE-2026-8195 published to NVD
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8195

Vulnerability Analysis

The vulnerability exists in JeecgBoot's CommonController.java, which manages file uploads and retrieval. The SVG file handler accepts user-supplied SVG content without stripping or neutralizing embedded script content. SVG is an XML-based format that natively supports <script> elements and JavaScript event handlers such as onload. When the server stores and later serves these files with an XML or SVG content type, browsers parse and execute the embedded JavaScript.

The attack requires user interaction, since a victim must view or open the uploaded SVG. The EPSS score is 0.033 percent, reflecting limited large-scale exploitation activity at this time. However, a public proof-of-concept is available in a GitHub repository, lowering the technical barrier for opportunistic attackers.

Root Cause

The root cause is missing output sanitization and improper content handling for SVG uploads. The application does not strip <script> tags, event handlers, or javascript: URIs from uploaded SVG content. It also serves the file with a content type that triggers script execution rather than forcing download or a safe MIME type such as image/svg+xml; charset=utf-8 paired with a Content-Security-Policy that blocks inline scripts.

Attack Vector

An attacker with upload privileges submits an SVG file containing malicious JavaScript through the JeecgBoot file upload endpoint handled by CommonController.java. When another user, often an administrator, accesses the file URL, the embedded script executes within the JeecgBoot origin. Consequences include session cookie theft, CSRF action chaining, credential harvesting through injected forms, and lateral movement to administrative functions. The attack is delivered over the network and requires victim interaction.

No verified exploit code is reproduced here. Refer to the GitHub PoC Repository and the VulDB #362347 advisory for technical reproduction details.

Detection Methods for CVE-2026-8195

Indicators of Compromise

• SVG files stored in JeecgBoot upload directories containing <script> tags, onload, onerror, or javascript: URIs
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing uploaded files
• HTTP POST requests to JeecgBoot upload endpoints with Content-Type: image/svg+xml originating from low-privilege accounts

Detection Strategies

• Scan stored files in JeecgBoot upload directories for SVG content containing executable JavaScript patterns
• Inspect web server access logs for unusual SVG uploads followed by repeated retrieval by privileged accounts
• Deploy a Content Security Policy in report-only mode to identify inline script execution from served SVG files

Monitoring Recommendations

• Alert on file uploads where the declared MIME type is image/svg+xml and the payload contains script-related keywords
• Monitor administrator session activity for anomalous API calls performed immediately after viewing uploaded media
• Track JeecgBoot version inventory across the environment to identify hosts still running 3.9.1 or earlier

How to Mitigate CVE-2026-8195

Immediate Actions Required

• Restrict SVG uploads at the application or reverse-proxy layer until a patched JeecgBoot release is deployed
• Force SVG files to be served with Content-Disposition: attachment to prevent inline browser rendering
• Audit existing uploaded SVG files and remove any containing script content or active event handlers
• Limit file upload permissions to trusted user roles only

Patch Information

No vendor patch has been published. According to the disclosure, the JeecgBoot maintainers did not respond to coordinated disclosure attempts. Monitor the JeecgBoot project for future releases addressing the SVG handler in CommonController.java.

Workarounds

• Implement server-side SVG sanitization using a library such as DOMPurify (server-side via JSDOM) or a Java equivalent before storing uploads
• Apply a strict Content Security Policy that disallows inline scripts and restricts script sources for pages serving user-uploaded content
• Configure the web server to serve user uploads from a separate sandboxed domain to isolate any executed scripts from the main application origin
• Add WAF rules that block uploads of XML or SVG content containing <script>, onload=, or javascript: substrings

# Nginx example: force SVG downloads instead of inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}