What is the CVSS score of EUVD-2026-26396?

EUVD-2026-26396 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of JeeSite are affected by EUVD-2026-26396?

JeeSite v5.15.1 contains a path traversal vulnerability in its file upload functionality that permits authenticated users to write files outside intended directories, potentially enabling remote code…

How to fix or mitigate EUVD-2026-26396?

Within 24 hours: Identify all JeeSite v5.15.1 instances in your environment and document which users have file upload permissions; restrict upload functionality to administrators only pending remediation. Within 7 days: Contact JeeSite vendor for patch availability and timeline; implement network-level access controls to limit file upload endpoint (/a/file/upload) to trusted networks only. Within 30 days: Apply vendor-released patch immediately upon availability or migrate to patched JeeSite version; conduct access review to remove unnecessary upload permissions from non-administrative accounts.

JeeSite EUVD-2026-26396

| CVE-2026-36762 HIGH

Path Traversal (CWE-22)

2026-04-30 mitre

Path Traversal File Upload N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 18:22 vuln.today

CVSS changed

May 04, 2026 - 18:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 18:00 euvd

EUVD-2026-26396

Analysis Generated

Apr 30, 2026 - 18:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.

AnalysisAI

Path traversal in JeeSite v5.15.1's file upload endpoint allows authenticated users with file upload permissions to write arbitrary files to any filesystem location, enabling remote code execution by uploading malicious files (e.g., JSP webshells) outside intended directories. The vulnerability exists in the fileEntityId parameter of /a/file/upload, bypassing directory restrictions while respecting file extension whitelists. EPSS score of 0.01% (3rd percentile) indicates low predicted exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, though vendor issue tracker discussion provides technical details that could facilitate POC development.

Technical ContextAI

JeeSite is a Java-based rapid development platform built on Spring Boot, commonly used for enterprise content management and administrative systems. This vulnerability manifests as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the file upload handling component. The /a/file/upload endpoint processes the fileEntityId parameter without proper path canonicalization or traversal sequence filtering, allowing authenticated users to inject directory traversal sequences (../) to escape the intended upload directory. While file extension validation remains intact (preventing upload of arbitrary extensions), attackers can still write whitelisted file types (such as .jsp, .jspx, or image formats with embedded code) to sensitive locations like webroot directories or configuration paths. The Spring Boot framework's default servlet mapping and file serving behavior can then execute uploaded JSP files if placed in accessible web directories, converting the path traversal into remote code execution.

RemediationAI

Upgrade JeeSite to version 5.15.2 or later when vendor releases patched version addressing GitHub issue #529 (https://github.com/thinkgem/jeesite/issues/529 - monitor for resolution commits). As of this analysis, no released patched version is independently confirmed; security teams should subscribe to the GitHub repository's security notifications and issue tracker for updates. Compensating controls until patch availability: (1) Restrict file upload permissions to only essential administrator accounts through JeeSite's role management, reducing attack surface by limiting who can invoke the vulnerable endpoint - trade-off is reduced operational flexibility for content managers. (2) Implement web application firewall (WAF) rules to detect and block requests containing directory traversal sequences (../, ..\, URL-encoded variants %2e%2e%2f) in fileEntityId parameter - may cause false positives if legitimate file identifiers contain periods. (3) Configure servlet container (Tomcat/Jetty) to prevent execution of JSP files in upload directories through security constraints in web.xml or deny scriptlet execution - this limits RCE but allows arbitrary file write to other locations. (4) Deploy file integrity monitoring on JeeSite installation directories to detect unauthorized file modifications outside expected upload paths. Verify vendor advisory at https://github.com/thinkgem/jeesite for official remediation guidance.