CVE-2026-86228: JeecgBoot AiragModelController.java exportXls access control
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JeecgBootto a version that resolves this vulnerability.Fixed in 3.9.5Patch a2be896f753936956ee6863b632b8e5a0231345c
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack is remote but requires low privileges (PR:L). Exploitation involves manipulating the credential argument supplied to the affected export function.
Which deployments should be prioritized for remediation?
JeecgBoot deployments running versions up to 3.9.3 should be prioritized, particularly where the affected Airag model export functionality is remotely reachable by low-privileged users. A public exploit has been disclosed.
What is the recommended remediation?
Upgrade the affected component to JeecgBoot version 3.9.5. The identified patch is a2be896f753936956ee6863b632b8e5a0231345c.
How can I determine whether my code includes the affected functionality?
Check the Airag module for AiragModelController.java at jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/. The affected function is exportXls.