PT-2025-30165 · Thinkgem · Jeesite

Zast.Ai · Published 2025-07-20 · Updated 2025-11-11 · CVE-2025-7863

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0

Description An open redirect issue exists in the redirectUrl function located in the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the url argument can lead to an open redirect, allowing for remote exploitation.

Recommendations Apply the patch 3d06b8d009d0267f0255acc87ea19d29d07cedc3 to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-7863

Affected Products

Jeesite

References · 15

• 🔥 https://github.com/thinkgem/jeesite5/issues/30 · Exploit
• 🔥 https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 · Exploit
• https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-7863 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7863 · Vendor Advisory
• https://twitter.com/CVEnew/status/1946772889132261383 · Twitter Post
• https://vuldb.com/?ctiid.316976 · Note
• https://t.me/cvetracker/28239 · Telegram Post
• https://twitter.com/jmdevlabs/status/1952395576747725012 · Twitter Post
• https://t.me/cvenotify/129576 · Telegram Post
• https://twitter.com/marcin_brz81183/status/1946819501271519467 · Twitter Post
• https://vuldb.com/?submit.618188 · Note
• https://vuldb.com/?id.316976 · Note
• https://twitter.com/VulmonFeeds/status/1946780054567919701 · Twitter Post
• https://twitter.com/zast_ai/status/1988257048329679246 · Twitter Post