CVE-2026-3026 - Vulnerability Analysis

Overview

erzhongxmu JEEWMS 3.7 contains a server-side request forgery caused by manipulation of the "upfile" argument in /plug-in/ueditor/jsp/getRemoteImage.jsp, letting remote attackers make arbitrary requests, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive information.

Mitigation

Update to the latest version or apply vendor patches when available.

References

• https://vuldb.com/?id.347382
• https://vuldb.com/?submit.756522
• https://www.notion.so/JEEWMS-SSRF-Vulnerability-in-UEditor-Module-304ea92a3c41806782b1f7285ab0d580
• https://vuldb.com/?ctiid.347382

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner