CVE-2026-36760

Name of the Vulnerable Software and Affected Versions JeeSite version 5.15.1

Description An issue in the '/a/file/upload' endpoint allows authenticated attackers with file upload permissions to perform path traversal and write arbitrary files with whitelisted suffixes to any location on the filesystem when chunked upload is enabled. This is possible via the fileMd5 parameter.

Recommendations As a temporary workaround, restrict access to the '/a/file/upload' endpoint or disable the chunked upload feature to prevent the use of the fileMd5 parameter for unauthorized file writes.