CVE-2026-36760
Published: 30 April 2026
Summary
CVE-2026-36760 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the path traversal flaw in the JeeSite file upload endpoint by applying vendor patches or updates.
Validates the fileMd5 parameter and other inputs to block path traversal sequences during chunked file uploads.
Enforces approved access authorizations to restrict authenticated users from writing files to unauthorized filesystem locations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing file upload endpoint enables exploitation of the web application for initial access (T1190) and direct deployment of web shells via arbitrary file write to allowed locations (T1505.003).
NVD Description
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is…
more
enabled.
Deeper analysisAI
CVE-2026-36760 is a path traversal vulnerability (CWE-22) in the fileMd5 parameter of the /a/file/upload endpoint in JeeSite version 5.15.1. Published on 2026-04-30, it enables authenticated attackers with file upload permissions to write arbitrary files with whitelisted suffixes to arbitrary filesystem locations when chunked upload is enabled. The vulnerability has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
An authenticated attacker with file upload permissions can exploit this remotely over the network with low attack complexity and no user interaction required. By manipulating the fileMd5 parameter during chunked uploads, they can achieve path traversal, allowing them to place files with permitted suffixes anywhere on the filesystem. This results in high confidentiality and integrity impacts due to the changed scope, potentially compromising sensitive data or enabling further system abuse.
Mitigation details and discussions are available in the project's GitHub repository at https://github.com/thinkgem/jeesite and the associated issue tracker at https://github.com/thinkgem/jeesite/issues/530. Security practitioners should review these for patches, workarounds, or configuration changes, such as disabling chunked uploads.
Details
- CWE(s)