CVE-2026-3404

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.15.1

Description A flaw exists in thinkgem JeeSite, potentially allowing for xml external entity reference. This issue is related to a function within the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the Endpoint component. The attack can be performed remotely and is considered highly complex, with difficult exploitability. The exploit has been published. The vendor was contacted but did not respond.

Recommendations Versions prior to 5.15.1 should be updated.