This vulnerability involves improper validation of the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1. Authenticated attackers who have permission to upload files can perform a path traversal attack when chunked upload is enabled. This allows them to write files with allowed suffixes to arbitrary filesystem paths, potentially leading to unauthorized file creation or modification. The vulnerability is confirmed published but lacks a CVSS score and vendor remediation details.

The impact is the ability for authenticated users with upload permissions to write arbitrary files to arbitrary locations on the server filesystem. This could lead to unauthorized file creation or modification, which may facilitate further attacks depending on the files written and their locations. There is no information about exploitation in the wild or additional impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and consider disabling chunked uploads if feasible to reduce exposure.