Volerion logoVolerion
Volerion logoVolerion

Jeecg Boot Command Injection Vulnerability in JimuReport Component

Vulnerability

A command injection vulnerability has been identified in the Jeecg Boot framework, specifically within the JimuReport component, versions 3.0.0 through 3.5.3. This vulnerability allows attackers to execute arbitrary code by sending a crafted HTTP request. The issue arises from insufficient input validation, which enables remote code execution through malicious FreeMarker templates.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Jeecg Boot is running.

Added: Apr 1, 2026, 5:22 PM
Updated: Apr 1, 2026, 5:22 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
10.0
exploitability
4.7
remediation
0.0
relevance
5.1
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.