CVE-2019-17352: Jfinal

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

Affected products

• Jfinal Jfinal: before 4.4 (fixed in 4.4)

Published 2019-10-08. Last modified 2026-06-17.