Executive brief
JeeecgBoot jeewx-boot is a WeChat management platform written in Java that handles official accounts, mini programs, and third-party integrations. The file upload feature improperly validates file extensions and content, allowing authenticated attackers to upload dangerous files such as JSP webshells to the server, potentially leading to remote code execution and full system compromise.
Technical details
The MyJwWebJwid3Controller.doUpload endpoint contains an unrestricted file upload vulnerability due to two weaknesses: (1) the file extension is extracted directly from the attacker-controlled original filename using substring(lastIndexOf(".")) without validation, and (2) uploaded bytes are written directly to disk without content verification or magic byte checking. An authenticated attacker can send a multipart POST request to /commonweixin/back/myJwWebJwid3/doUpload with a filename such as shell.jsp to upload executable server-side templates. There is no allowlist of permitted extensions, no content-type validation, and no re-encoding of file content. The project has not yet responded to the vulnerability report.
Affected products
- JeecgBoot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd
Timeline
- 2026-06-03: disclosed: Vulnerability report opened on GitHub
- 2026-08-31: advisory: CVE-2026-82629 published