CVE-2026-108646: JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide syscategory dictionary, including under existing parent nodes.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated JeecgBoot user, including low-privileged accounts, can exploit the affected import handler. No user interaction is required.
What does an attacker need to submit?
The attacker needs to upload a crafted Excel workbook to the /sys/category/importExcel endpoint. The workbook can be used to bulk insert arbitrary category dictionary nodes, including nodes under existing parent nodes.
What data or system functions are affected?
The issue affects the system-wide sys_category dictionary. Successful exploitation permits unauthorized modification by adding category entries; the provided information does not indicate confidentiality impact or service disruption.