CVE-2026-108647: JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What capability does exploitation provide?
A low-privileged user can upload a crafted Excel workbook to bulk-create system-wide encoding validation rules with arbitrary regular expression patterns. This bypasses the system:checkRule:add permission normally required to add those rules.
How can defenders identify possible exploitation?
Review use of the /sys/checkRule/importExcel handler and inspect existing encoding validation rules for unauthorized or unexpected bulk-created entries, particularly rules containing unapproved regular expression patterns.