CVE-2026-2111: JeecgBoot Retrieval-Augmented Generation edit path traversal
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the component Retrieval-Augmented Generation Module. Executing a manipulation of the argument filePath can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2111?
The severity of CVE-2026-2111 has not been explicitly categorized but it involves path traversal vulnerabilities which can lead to unauthorized file access.
How do I fix CVE-2026-2111?
To fix CVE-2026-2111, it is recommended to upgrade JeecgBoot to the latest version above 3.9.0 where this vulnerability is addressed.
What components are affected by CVE-2026-2111?
CVE-2026-2111 affects the Retrieval-Augmented Generation Module within JeecgBoot versions up to 3.9.0.
What kind of attack can exploit CVE-2026-2111?
An attacker can exploit CVE-2026-2111 by manipulating file paths in the affected module to gain unauthorized access to server files.
Is CVE-2026-2111 specific to certain software versions?
Yes, CVE-2026-2111 specifically affects JeecgBoot versions up to and including 3.9.0.