JeeCgBoot v3.9.5 Patch: Fixes for RCE, SQLi, SSRF, XSS & Shiro Upgrade

JeeCgBoot v3.9.5 Vulnerability Remediation Summary Vulnerability Overview This update implements targeted hardening for multiple security vulnerabilities, primarily addressing: Broken Access Control: Fixed broken access control issues Sensitive Information Disclosure: Fixed sensitive information disclosure issues SQL Injection: Fixed SQL injection issues Remote Code Execution: Fixed remote code execution issues SSRF: Fixed Server-Side Request Forgery (SSRF) issues Stored XSS: Fixed stored Cross-Site Scripting (XSS) issues File Upload Vulnerabilities: Fixed file upload vulnerabilities Cookie Security: Fixed Cookie security issues Scope of Impact Associated CVE identifiers: CVE-2026-5616, CVE-2026-1819, CVE-2026-6579, CVE-2026-9588, CVE-2026-9894, CVE-2026-10320, CVE-2026-11164, CVE-2026-10900, CVE-2026-67929 Affected components: Upgraded Apache Shiro from 1.2.5 to 3.0.0; upgraded shiro-redis from 3.2.3 to 4.10 Affected modules: AI Flow script nodes, Online reports, AI chat, SVG file upload, announcements/notices, AI chat and remote file access control, code execution in AI Flow script nodes, AI chat, Online reports, AI chat, SVG file upload, and announcements/notices Remediation Fixed security vulnerabilities including broken access control, sensitive information disclosure, SQL injection, remote code execution, SSFR, and stored XSS Fixed Cookie security issues Upgraded Apache Shiro from 1.2.5 to 3.0.0 Upgraded shiro-redis from 3.2.3 to 4.10 Mitigated code execution risks in AI Flow script nodes Enhanced XSS protection for AI chat, Online reports, AI chat, SVG file upload, and announcements/notices Enhanced SQL injection detection and mitigated SQL injection risks in Online reports Enhanced permission validation for dictionary queries in Online reports Enhanced access control for AI chat and remote file access Fixed HTML injection risks in Excel import template hints

Goal Reached Thanks to every supporter — we hit 100%!

JeeCgBoot v3.9.5 Patch: Fixes for RCE, SQLi, SSRF, XSS & Shiro Upgrade

More from this source