CVE-2026-36762 is a path traversal vulnerability affecting JeeSite version 5.15.1. It arises from insufficient validation of the fileEntityId parameter in the /a/file/upload endpoint, allowing authenticated attackers with file upload permissions to write files with whitelisted suffixes to arbitrary filesystem locations. This can lead to unauthorized file creation or modification, impacting system confidentiality, integrity, and availability. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

Successful exploitation allows an authenticated user with file upload permissions to perform arbitrary file writes on the server filesystem within the constraints of whitelisted file suffixes. This can lead to unauthorized modification or creation of files, potentially compromising system confidentiality, integrity, and availability. The high CVSS score (8.8) reflects the serious nature of this vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and monitor for suspicious activity related to file uploads. Avoid granting unnecessary file upload privileges. Follow vendor communications closely for updates on patches or official mitigations.