JeeSite CVE-2025-7864

Apply the vendor-released patch from commit 3585737d21fe490ff6948d913fcbd8d99c41fc08 (https://github.com/thinkgem/jeesite5/commit/3585737d21fe490ff6948d913fcbd8d99c41fc08) to address the unrestricted upload vulnerability. If a formal release version incorporating this patch is available, upgrade to that version; otherwise, cherry-pick the commit or rebuild from the patched source. As a compensating control prior to patching, restrict file upload functionality by disabling or removing access to the FileUploadController endpoint if not actively required by business operations, or implement strict network access controls limiting the upload endpoint to trusted internal networks and removing external/public access. Additionally, configure the web server and application to prevent execution of uploaded files in the upload directory by setting appropriate file permissions (remove execute bits) and web server directives (e.g., disable script execution in upload directories via .htaccess, nginx location blocks, or Tomcat security manager policies). Validate that uploaded files are stored outside the web root or in a dedicated non-executable directory. These controls reduce the immediate impact from file upload to remote code execution but do not eliminate the underlying vulnerability; patching remains the primary remediation.