CVE-2025-7759
Published: 17 July 2025
Summary
CVE-2025-7759 is a low-severity SSRF (CWE-918) vulnerability in Jeesite Jeesite. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2025-7759 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting thinkgem JeeSite versions up to 5.12.0. The issue resides in the UEditor Image Grabber component, specifically in the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java, where manipulation of the "Source" argument triggers the SSRF.
With a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), the vulnerability can be exploited remotely by an attacker possessing low privileges. Exploitation requires no user interaction and enables limited impacts on confidentiality, integrity, and availability through SSRF, such as unauthorized internal requests from the server.
Mitigation is provided via the patch commit 1c5e49b0818037452148e0f8ff69ed04cb8fefdc in the thinkgem/jeesite5 GitHub repository, as detailed in the associated issue at https://github.com/thinkgem/jeesite5/issues/27. A public proof-of-concept exploit is available at https://github.com/MentalityXt/jeesite_ssrf/tree/main, and administrators are advised to apply the patch promptly. Additional details appear in VulDB entries at https://vuldb.com/?ctiid.316749 and https://vuldb.com/?id.316749.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21831
Vulnerability details
A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be…
more
performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing UEditor component enables exploitation for initial access (T1190), internal network service discovery via arbitrary requests (T1046), and cloud metadata access for instance discovery (T1522) and application credential theft (T1528, T1552.005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the CVE by validating/sanitizing the untrusted 'Source' argument before the UEditor component performs outbound fetches.
Enforces policy-based information flow rules that can deny the server from initiating requests to arbitrary internal or external destinations supplied by the attacker.
Boundary-protection mechanisms can restrict or monitor the unauthorized outbound connections that constitute the SSRF exploit.