PT-2026-36131 · Jeesite · Jeesite

Arron-Bit · Published 2026-04-30 · Updated 2026-05-12 · CVE-2026-36760

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions JeeSite version 5.15.1

Description An issue in the '/a/file/upload' endpoint allows authenticated attackers with file upload permissions to perform path traversal and write arbitrary files with whitelisted suffixes to any location on the filesystem when chunked upload is enabled. This is possible via the fileMd5 parameter.

Recommendations As a temporary workaround, restrict access to the '/a/file/upload' endpoint or disable the chunked upload feature to prevent the use of the fileMd5 parameter for unauthorized file writes.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-36760

Affected Products

Jeesite

References · 10

• 🔥 https://github.com/thinkgem/jeesite/issues/530 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36760 · Security Note
• https://github.com/thinkgem/jeesite · Note
• https://twitter.com/VulmonFeeds/status/2049959427101380711 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054105867847426561 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049914548166033760 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054105866127695979 · Twitter Post
• https://t.me/CVEtracker/52332 · Telegram Post
• https://twitter.com/CVEnew/status/2049913886799769661 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054105865246933273 · Twitter Post