CVE-2026-3026
Published: 23 February 2026
Summary
CVE-2026-3026 is a medium-severity SSRF (CWE-918) vulnerability in Jeewms Jeewms. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-3026 is a server-side request forgery (SSRF) vulnerability affecting erzhongxmu JEEWMS version 3.7, specifically in the UEditor component. The issue resides in the file /plug-in/ueditor/jsp/getRemoteImage.jsp, where manipulation of the "upfile" argument enables the SSRF. Classified under CWE-918, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-02-23.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to make unauthorized requests from the server to internal or external resources.
Advisories from VulDB and a Notion page detail the vulnerability and public disclosure of an exploit, but the vendor was contacted early without response, indicating no official patches or mitigations are available. Security practitioners should restrict access to the affected endpoint and monitor for exploitation attempts.
The exploit has been publicly disclosed and may be actively used, though no confirmed real-world incidents are reported in available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7502
Vulnerability details
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in unauthenticated public-facing JSP endpoint directly enables remote exploitation of web application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces information flow rules that block the server from initiating unauthorized outbound requests to attacker-supplied destinations via the upfile parameter in getRemoteImage.jsp.
Applies boundary protection to restrict the web application's ability to make arbitrary remote requests, directly mitigating the SSRF vector in the UEditor component.
Requires validation of the upfile input to reject malformed or internal URLs before the getRemoteImage.jsp handler processes them.