EUVD-2026-26396Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
AnalysisAI
Path traversal in JeeSite v5.15.1's file upload endpoint allows authenticated users with file upload permissions to write arbitrary files to any filesystem location, enabling remote code execution by uploading malicious files (e.g., JSP webshells) outside intended directories. The vulnerability exists in the fileEntityId parameter of /a/file/upload, bypassing directory restrictions while respecting file extension whitelists. EPSS score of 0.01% (3rd percentile) indicates low predicted exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, though vendor issue tracker discussion provides technical details that could facilitate POC development.
Technical ContextAI
JeeSite is a Java-based rapid development platform built on Spring Boot, commonly used for enterprise content management and administrative systems. This vulnerability manifests as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the file upload handling component. The /a/file/upload endpoint processes the fileEntityId parameter without proper path canonicalization or traversal sequence filtering, allowing authenticated users to inject directory traversal sequences (../) to escape the intended upload directory. While file extension validation remains intact (preventing upload of arbitrary extensions), attackers can still write whitelisted file types (such as .jsp, .jspx, or image formats with embedded code) to sensitive locations like webroot directories or configuration paths. The Spring Boot framework's default servlet mapping and file serving behavior can then execute uploaded JSP files if placed in accessible web directories, converting the path traversal into remote code execution.
RemediationAI
Upgrade JeeSite to version 5.15.2 or later when vendor releases patched version addressing GitHub issue #529 (https://github.com/thinkgem/jeesite/issues/529 - monitor for resolution commits). As of this analysis, no released patched version is independently confirmed; security teams should subscribe to the GitHub repository's security notifications and issue tracker for updates. Compensating controls until patch availability: (1) Restrict file upload permissions to only essential administrator accounts through JeeSite's role management, reducing attack surface by limiting who can invoke the vulnerable endpoint - trade-off is reduced operational flexibility for content managers. (2) Implement web application firewall (WAF) rules to detect and block requests containing directory traversal sequences (../, ..\, URL-encoded variants %2e%2e%2f) in fileEntityId parameter - may cause false positives if legitimate file identifiers contain periods. (3) Configure servlet container (Tomcat/Jetty) to prevent execution of JSP files in upload directories through security constraints in web.xml or deny scriptlet execution - this limits RCE but allows arbitrary file write to other locations. (4) Deploy file integrity monitoring on JeeSite installation directories to detect unauthorized file modifications outside expected upload paths. Verify vendor advisory at https://github.com/thinkgem/jeesite for official remediation guidance.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today