CVE-2026-36762
HighSummary
JeeSite version 5.15.1 contains a vulnerability in the fileEntityId parameter in the /a/file/upload endpoint, allowing authenticated attackers with file upload permissions to perform a path traversal attack and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
Risk Assessment
This vulnerability may lead to unauthorized access to the filesystem, posing a risk of data leakage or the introduction of malicious software.
Recommendation
It is recommended to upgrade to the latest version of JeeSite and restrict file upload permissions to trusted users only.
Other vulnerabilities in JeeSite v5.15.1
See all- CVE-2023-38991Medium
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
- CVE-2023-38988Medium
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Original NVD description (English source)
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.