CVE-2026-36760 Details

A path traversal vulnerability has been identified in JeeSite version 5.15.1 and earlier. This issue arises in the chunked file upload mode, specifically through the 'fileMd5' parameter of the '/a/file/upload' endpoint. When chunked upload is enabled, authenticated attackers with file upload permissions can exploit this vulnerability to write files with whitelisted extensions to arbitrary locations on the filesystem. The vulnerability bypasses content-type validation, allowing potentially harmful files to be uploaded and executed.

Users are advised to update to JeeSite version 5.15.2 or later, where this vulnerability has been addressed. For those using version 5.15.0, it is recommended to run 'mvn package -U' to update dependencies and repackage the project.