CVE-2025-7759

MediumPublic PoC

Published: 17 July 2025

Published

17 July 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0014 33.9th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7759 is a medium-severity SSRF (CWE-918) vulnerability in Jeesite Jeesite. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

T1552.005 Cloud Instance Metadata API Credential Access

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

attack.mitre.org →

T1528 Steal Application Access Token Credential Access

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

attack.mitre.org →

Why these techniques?

SSRF in public-facing UEditor component enables exploitation for initial access (T1190), internal network service discovery via arbitrary requests (T1046), and cloud metadata access for instance discovery (T1522) and application credential theft (T1528, T1552.005).

NVD Description

A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be…

performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.

Deeper analysisAI

CVE-2025-7759 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting thinkgem JeeSite versions up to 5.12.0. The issue resides in the UEditor Image Grabber component, specifically in the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java, where manipulation of the "Source" argument triggers the SSRF.

With a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), the vulnerability can be exploited remotely by an attacker possessing low privileges. Exploitation requires no user interaction and enables limited impacts on confidentiality, integrity, and availability through SSRF, such as unauthorized internal requests from the server.

Mitigation is provided via the patch commit 1c5e49b0818037452148e0f8ff69ed04cb8fefdc in the thinkgem/jeesite5 GitHub repository, as detailed in the associated issue at https://github.com/thinkgem/jeesite5/issues/27. A public proof-of-concept exploit is available at https://github.com/MentalityXt/jeesite_ssrf/tree/main, and administrators are advised to apply the patch promptly. Additional details appear in VulDB entries at https://vuldb.com/?ctiid.316749 and https://vuldb.com/?id.316749.