CVE-2026-10241: JimuReport SSRF in File Download Function – Patch to 3.9.2

Technical summary

The vulnerability exists in the FileDownloadUtils.download2DiskFromNet function within the /airag/app/debug endpoint of jeecgboot. This function fails to properly validate or restrict the network destinations it connects to when downloading files. An attacker with valid credentials can specify arbitrary URLs, causing the server to initiate HTTP/HTTPS requests to internal or restricted systems. This maps to CWE-918 (Server-Side Request Forgery), a class of attacks that exploit backend services' trusted network position to pivot toward internal infrastructure.

Business impact

An authenticated user—potentially an insider or someone with compromised credentials—can abuse this function to enumerate and interact with internal services, cloud metadata endpoints (a particularly high-value target in cloud-native deployments), or other backend systems. This could lead to exposure of sensitive configuration data, API keys, authentication tokens, or credentials stored in metadata services. In multi-tenant or managed service scenarios, this may enable cross-tenant data access or lateral movement within the infrastructure.

Affected systems

JimuReport (jeecgboot) through version 3.9.1 is affected. The vulnerability is specific to installations that expose the /airag/app/debug endpoint and require authentication; however, the presence of a debug endpoint in production is itself a significant operational risk. Verify your deployed version against your vendor's release notes and confirm whether the debug endpoint is accessible in your environment.

Exploitability

The attack requires valid credentials (PR:L in the CVSS vector), but no user interaction is needed. Public exploit code is available, lowering the bar for attackers. The network-accessible nature (AV:N) and low attack complexity (AC:L) mean that any authenticated user—including low-privileged employees or attackers using compromised accounts—can execute this attack with readily available tools.

Remediation

Upgrade jeecgboot to version 3.9.2 or later, which mitigates this vulnerability. Additionally, apply defense-in-depth practices: restrict network access to the /airag/app/debug endpoint (disable in production if possible), implement egress filtering on your application servers to limit outbound connections to known-required services, and audit any debug or admin endpoints for unnecessary exposure.

Patch guidance

Vendor guidance indicates that upgrading to version 3.9.2 resolves this issue. Verify the current version of jeecgboot in your environment and test the patch in a non-production setting before production deployment. If you cannot upgrade immediately, consider disabling or network-restricting access to the /airag/app/debug endpoint and review IAM policies to limit who holds credentials that can reach this endpoint.

Detection guidance

Monitor outbound HTTP/HTTPS connections from your jeecgboot application servers, particularly to unexpected or internal IP ranges, cloud metadata service IPs (169.254.169.254), or unusual ports. Log and alert on requests to the /airag/app/debug endpoint. Review application logs for calls to FileDownloadUtils.download2DiskFromNet with suspicious URLs. In cloud environments, enable VPC Flow Logs or equivalent to detect unexpected egress traffic patterns from application instances.

Why prioritize this

Although the CVSS score is MEDIUM (6.3), this vulnerability warrants prompt attention because: (1) public exploit code is available, (2) it targets a particularly sensitive attack surface—cloud metadata endpoints—which could expose credentials and configuration, and (3) the presence of a debug endpoint in production is often overlooked in risk assessments. For cloud-hosted deployments, prioritize this higher due to metadata exposure risk.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible vulnerability requiring low privileges and causing limited confidentiality, integrity, and availability impact (C:L, I:L, A:L). The score does not account for the widespread use of cloud deployments where metadata exposure has outsized business impact, nor does it weight the availability of public exploits. Security teams should consider their deployment context—particularly cloud infrastructure—when prioritizing this above the nominal MEDIUM rating.

Frequently asked questions