Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

JeeSite v5.15.1 allows attackers to upload files anywhere on the server

CVE-2026-36762 · published 6 months ago
Summary

A security issue in JeeSite v5.15.1 allows attackers who have permission to upload files to put files in any location on the server. This could be used to create malicious files that harm your business. Update to a fixed version of JeeSite to protect your system.

Original advisory text
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary ...
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published30 Apr 2026
Updated4 Nov 2026
First seen30 Apr 2026
Sources
CVE-2026-36762 · NVD
Track software like this
Free during beta