CVE-2026-58375— JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
Possible ATT&CK Techniques 3AI
T1190 · Exploit Public-Facing Application T1005 · Data from Local System T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jeecgboot | jimureport | ≤ 2.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58375
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
Source: NVD (National Vulnerability Database)
Vulnerability Description
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Jeecg jimureport 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jeecg JimuReport是中国Jeecg公司开源的一个免费报表工具。 Jeecg jimureport 2.5.0及之前版本存在授权问题漏洞，该漏洞源于身份验证缺失，导致未经身份验证的攻击者通过POST /jmreport/auto/export端点未授权访问，可枚举Snowflake报告标识并导出包括SQL查询返回数据和数据源中嵌入凭据在内的完整报告内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jeecgboot | jimureport | 0 ~ 2.5.0 | - |
II. Public POCs for CVE-2026-58375
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8560 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-58375
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-58375 (1)
Other References for CVE-2026-58375 (1)
IV. Related Vulnerabilities
Same product: jimureport
- CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManage - CVE-2025-10771
jeecgboot JimuReport DB2 JDBC testConnection deserialization - CVE-2025-10770
jeecgboot JimuReport MySQL JDBC testConnection deserializati - CVE-2025-8963
jeecgboot JimuReport Data Large Screen Template testConnecti - CVE-2023-6307
jeecgboot JimuReport image path traversal
Same vendor: jeecgboot
- CVE-2026-58377
JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credentia - CVE-2026-10241
jeecgboot The server processes these URLs Cloud Instance Met - CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManage - CVE-2025-12626
jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java ge - CVE-2025-10771
jeecgboot JimuReport DB2 JDBC testConnection deserialization
Same weakness: CWE-306
V. Comments for CVE-2026-58375
No comments yet