EUVD-2026-26396CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
AnalysisAI
Path traversal in JeeSite v5.15.1's file upload endpoint allows authenticated users with file upload permissions to write arbitrary files to any filesystem location, enabling remote code execution by uploading malicious files (e.g., JSP webshells) outside intended directories. The vulnerability exists in the fileEntityId parameter of /a/file/upload, bypassing directory restrictions while respecting file extension whitelists. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all JeeSite v5.15.1 instances in your environment and document which users have file upload permissions; restrict upload functionality to administrators only pending remediation. Within 7 days: Contact JeeSite vendor for patch availability and timeline; implement network-level access controls to limit file upload endpoint (/a/file/upload) to trusted networks only. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today