CVE-2026-36762 Details

A path traversal vulnerability has been identified in JeeSite version 5.15.1 and earlier. The issue arises in the fileEntityId parameter of the /a/file/upload endpoint, where authenticated attackers with file upload permissions can exploit the vulnerability to write arbitrary files with whitelisted suffixes to any location on the filesystem. This vulnerability could lead to remote code execution if, for example, a malicious JAR file is uploaded to a directory where it can be executed.

Sanitize the fileEntityId parameter in the FileUploadController to prevent path traversal. This can be done by validating the parameter to ensure it does not contain illegal characters or sequences before it is processed.