CVE-2026-2555: JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization. The attack can be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2555?
CVE-2026-2555 is considered to have a high severity due to its potential for remote code execution risks.
How do I fix CVE-2026-2555?
To mitigate CVE-2026-2555, update JeecgBoot to version 3.9.2 or later where the vulnerability has been addressed.
What is the impact of CVE-2026-2555?
The impact of CVE-2026-2555 includes the possibility of attackers exploiting deserialization vulnerabilities to execute arbitrary code.
Which versions of JeecgBoot are affected by CVE-2026-2555?
CVE-2026-2555 affects JeecgBoot versions prior to 3.9.2.
How can I identify if my application is vulnerable to CVE-2026-2555?
You can identify vulnerability to CVE-2026-2555 by reviewing your usage of the importDocumentFromZip function within the AiragKnowledgeController.java.