PT-2026-22535 · Thinkgem · Jeesite

Saul1213 + 1 · Published 2026-03-02 · Updated 2026-03-09 · CVE-2026-3404

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.15.1

Description A flaw exists in thinkgem JeeSite, potentially allowing for xml external entity reference. This issue is related to a function within the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the Endpoint component. The attack can be performed remotely and is considered highly complex, with difficult exploitability. The exploit has been published. The vendor was contacted but did not respond.

Recommendations Versions prior to 5.15.1 should be updated.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2026-3404

Affected Products

Jeesite

References · 10

• 🔥 https://yuque.com/la12138/pa2fpb/ew8x2qss8dv0bsu0?singleDoc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3404 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3404 · Vendor Advisory
• https://t.me/CVEtracker/46076 · Telegram Post
• https://t.me/cveNotify/154825 · Telegram Post
• https://t.me/cveNotify/153686 · Telegram Post
• https://vuldb.com/?ctiid.348299 · Note
• https://twitter.com/cyberbivash/status/2028338281792806919 · Twitter Post
• https://vuldb.com/?id.348299 · Note
• https://vuldb.com/?submit.763732 · Note