PT-2025-30166 · Thinkgem · Jeesite

Zast.Ai · CVE-2025-7864 · Published 2025-07-20 · Updated 2025-11-11

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0

Description A critical issue exists in thinkgem JeeSite that allows for unrestricted file uploads. The Upload function within the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java is affected. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Apply a patch with identifier 3585737d21fe490ff6948d913fcbd8d99c41fc08 to resolve this issue.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-7864

Affected Products

Jeesite

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7864.json · Exploit
• 🔥 https://github.com/thinkgem/jeesite5/issues/31 · Exploit
• https://github.com/thinkgem/jeesite5/commit/3585737d21fe490ff6948d913fcbd8d99c41fc08 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-7864 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7864 · Vendor Advisory
• https://github.com/thinkgem/jeesite5/issues/31#issuecomment-3051363397 · Note
• https://twitter.com/VulmonFeeds/status/1946777494712995927 · Twitter Post
• https://twitter.com/CVEnew/status/1946772888268194245 · Twitter Post
• https://twitter.com/marcin_brz81183/status/1946820380007842093 · Twitter Post
• https://vuldb.com/?submit.618189 · Note
• https://twitter.com/zast_ai/status/1988257048329679246 · Twitter Post
• https://vuldb.com/?ctiid.316977 · Note
• https://twitter.com/jmdevlabs/status/1952425777317691733 · Twitter Post
• https://t.me/cvenotify/129577 · Telegram Post
• https://t.me/cvetracker/28240 · Telegram Post