PT-2026-22535 · Thinkgem · Jeesite

Saul1213 + 1 · Publicado 2026-03-02 · Atualizado 2026-03-09 · CVE-2026-3404

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.15.1

Description A flaw exists in thinkgem JeeSite, potentially allowing for xml external entity reference. This issue is related to a function within the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the Endpoint component. The attack can be performed remotely and is considered highly complex, with difficult exploitability. The exploit has been published. The vendor was contacted but did not respond.

Recommendations Versions prior to 5.15.1 should be updated.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-610

CWE-611

Identificadores relacionados

CVE-2026-3404

Produtos afetados

Jeesite

Referências · 10

• 🔥 https://yuque.com/la12138/pa2fpb/ew8x2qss8dv0bsu0?singleDoc · Exploit
• https://t.me/CVEtracker/46076 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3404 · Nota de Segurança
• https://t.me/cveNotify/154825 · Publicação no Telegram
• https://t.me/cveNotify/153686 · Publicação no Telegram
• https://vuldb.com/?ctiid.348299 · Nota
• https://twitter.com/cyberbivash/status/2028338281792806919 · Publicação no Twitter
• https://vuldb.com/?id.348299 · Nota
• https://osv.dev/vulnerability/CVE-2026-3404 · Aviso do Fabricante
• https://vuldb.com/?submit.763732 · Nota