thinkgem JeeSite CVE-2025-7759

Upgrade JeeSite to a version patched after commit 1c5e49b0818037452148e0f8ff69ed04cb8fefdc (the fix is available at https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc). The patch should be applied to all instances running version 5.12.0 or earlier. If immediate patching is not feasible, implement compensating controls: (1) restrict network access from the JeeSite application server to internal and sensitive resources using firewall rules and egress filtering-block outbound connections to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and restrict access to internal services; (2) disable or restrict use of the UEditor Image Grabber feature if not required, or limit it to trusted file sources only; (3) implement strict authentication and authorization checks to ensure only trusted users can interact with image upload/download endpoints; (4) apply network-level monitoring to detect anomalous outbound requests from the application server that might indicate SSRF exploitation. These controls reduce exploitability but do not eliminate the underlying vulnerability.