What is the CVSS score of CVE-2026-36760?

CVE-2026-36760 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-36760?

Within 24 hours: Disable or restrict access to the /a/file/upload endpoint for all non-administrative users; audit recent file uploads via JeeSite logs for suspicious fileMd5 parameters or files written outside intended directories. Within 7 days: Inventory all JeeSite 5.15.1 deployments; assess feasibility of upgrading to patched version when available or migrating to alternative file management solutions. Within 30 days: Implement network-level controls (WAF rules to block path traversal patterns in fileMd5 parameter); conduct forensic review of filesystem for unauthorized files; deploy file integrity monitoring on critical configuration and executable paths.

CVE-2026-36760

EUVD-2026-26393 CRITICAL

Path Traversal (CWE-22)

2026-04-30 cve@mitre.org

Path Traversal File Upload

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 19:30 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

9.6 (CRITICAL)

EUVD ID Assigned

Apr 30, 2026 - 17:22 euvd

EUVD-2026-26393

Analysis Generated

Apr 30, 2026 - 17:22 vuln.today

CVE Published

Apr 30, 2026 - 17:16 nvd

CRITICAL 9.6

DescriptionCVE.org

An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.

AnalysisAI

Path traversal in JeeSite 5.15.1 allows authenticated users with file upload permissions to write arbitrary files to any filesystem location during chunked uploads by manipulating the fileMd5 parameter in /a/file/upload. Attackers can bypass directory restrictions to plant webshells, modify configuration files, or overwrite executables with whitelisted extensions, achieving remote code execution and full system compromise. Scope change in CVSS vector indicates container escape or cross-tenant impact in multi-tenant deployments. No active exploitation confirmed (not in CISA KEV) but vulnerability disclosed via GitHub issue #530.