CVE-2026-36760

—

CVSS 3.1

9.6 critical

EPSS

<1%p32

Published

Apr 30, 2026 (Apr 30, 2026)

Modified

Jun 17, 2026

Description

An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.

Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.