Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.
CVE-2025-61188
CVSS base score
6.3 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-24
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
jeecg jeecg boot
References
- github.com Exploit, Issue Tracking, Vendor Advisory