CVE-2026-3026: erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgery
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3026?
CVE-2026-3026 has been classified as a critical vulnerability due to its ability to enable server-side request forgery.
How do I fix CVE-2026-3026?
To fix CVE-2026-3026, it is recommended to update the erzhongxmu JEEWMS application to a patched version that addresses this vulnerability.
What are the impacts of CVE-2026-3026 exploitation?
Exploitation of CVE-2026-3026 can lead to unauthorized access to internal services and potential information leakage.
Which versions of erzhongxmu JEEWMS are affected by CVE-2026-3026?
CVE-2026-3026 impacts all versions of erzhongxmu JEEWMS where the UEditor component's getRemoteImage.jsp functionality is utilized.
Is there a workaround for CVE-2026-3026 if I cannot update immediately?
A temporary workaround for CVE-2026-3026 is to restrict access to the getRemoteImage.jsp file to trusted users or networks.