CVE-2025-60268 Details

An arbitrary file upload vulnerability has been identified in JeeWMS version 20250820. This vulnerability arises from inadequate file validation in the 'saveFiles' function of the 'cgUploadController' endpoint. As a result, an authenticated user with normal privileges could upload a malicious file that enabled remote code execution on the server.

It is recommended to implement strict file type whitelisting, validate and sanitize file names, store uploaded files outside the web root, remove execute permissions from upload directories, verify content types by inspecting file magic bytes, scan uploads for malicious content, apply least-privilege principles to the web application user and database credentials, and add logging and alerting for upload attempts.