CVE-2026-82629 Overview
CVE-2026-82629 is an unrestricted file upload vulnerability in jeecgboot jeewx-boot up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd. The flaw resides in the MyJwWebJwid3Controller.doUpload function within jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java. Attackers can manipulate the File argument to upload arbitrary content through the doUpload endpoint. The issue is tracked under CWE-284: Improper Access Control and requires authenticated network access. The exploit has been publicly disclosed. Because the project uses a rolling release model, no fixed version has been designated by the maintainers.
Critical Impact
Authenticated remote attackers can upload arbitrary files through the doUpload endpoint, creating a foothold for further compromise of the jeewx-boot host.
Affected Products
- jeecgboot jeewx-boot up to commit 641ab52c3e1845fec39996d7794c33fb40dad1dd
- jeewx-boot-module-weixin component
- MyJwWebJwid3Controller.doUpload endpoint
Discovery Timeline
- 2026-08-31 - CVE-2026-82629 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82629
Vulnerability Analysis
The vulnerability exists in the doUpload handler of MyJwWebJwid3Controller, part of the WeChat (weixin) integration module of jeewx-boot. The controller accepts a File argument from remote clients without enforcing sufficient constraints on file type, extension, MIME content, or destination path. Because the endpoint sits within a Spring MVC controller intended for authenticated back-office use, exploitation requires valid credentials with access to the WeChat management surface. Once inside, an attacker submits a crafted multipart upload that persists attacker-controlled content on the server file system.
Root Cause
The root cause is improper access control combined with missing validation of uploaded content in the doUpload function. The handler does not restrict which file types can be written, does not validate the destination directory, and does not verify that the uploaded content matches an expected format. This aligns with CWE-284: Improper Access Control and reflects a broader pattern of trust placed in authenticated user input.
Attack Vector
An attacker with valid privileges submits an HTTP POST request to the doUpload endpoint containing a multipart File parameter. The server writes the file to disk without validating its extension, MIME type, or contents. If the upload directory is reachable from a web-facing path or the file can be interpreted by the server runtime, the attacker may achieve execution or persistence. Refer to the GitHub Issue #48 Discussion and the VulDB CVE-2026-82629 Entry for further technical context. No verified proof-of-concept code has been published in a form suitable for reproduction here.
Detection Methods for CVE-2026-82629
Indicators of Compromise
- Unexpected files with executable extensions (.jsp, .jspx, .war, .sh) appearing in jeewx-boot upload directories.
- HTTP POST requests targeting the doUpload path of MyJwWebJwid3Controller from unusual source addresses or user agents.
- New or modified files under the WeChat module storage path with recent timestamps that do not correlate to legitimate administrative activity.
Detection Strategies
- Inspect application access logs for POST requests to WeChat back-office upload endpoints and correlate with the authenticated user identity.
- Monitor the jeewx-boot upload directory for file creation events involving script or archive extensions.
- Alert on server-side process launches (for example, java spawning sh, bash, or cmd.exe) originating from the jeewx-boot service account.
Monitoring Recommendations
- Enable verbose HTTP request logging on the reverse proxy fronting jeewx-boot, capturing multipart upload metadata.
- Forward file integrity monitoring and web access logs to a centralized analytics platform for correlation.
- Baseline normal administrative upload activity and alert on deviations in file type, size, or frequency.
How to Mitigate CVE-2026-82629
Immediate Actions Required
- Restrict network exposure of the jeewx-boot administrative interface to trusted management networks or VPN clients.
- Rotate credentials for all accounts with access to the WeChat management console, since exploitation requires high privileges.
- Audit the upload directory used by MyJwWebJwid3Controller.doUpload for unauthorized files and remove any suspicious artifacts.
Patch Information
The maintainer has not published a fix for CVE-2026-82629. Because jeewx-boot follows a rolling release model, no discrete patched version is available. Track the GitHub Repository for Jeewx Boot and GitHub Issue #48 Discussion for maintainer response and remediation commits.
Workarounds
- Place a web application firewall in front of jeewx-boot to block multipart uploads containing executable extensions or script content signatures.
- Configure the servlet container so that the upload directory is not served as executable content and cannot be interpreted as JSP or similar.
- Enforce least-privilege on the accounts that can reach the doUpload endpoint and disable administrative accounts that are not actively required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
