Threats tagged 'ghsa-r8pw-53pg-996h'

JeeSite version 5.15.1 contains a vulnerability in the fileEntityId parameter of the /a/file/upload endpoint. Authenticated users with file upload permissions can exploit this flaw to perform path traversal attacks, allowing them to write arbitrary files with whitelisted suffixes to arbitrary locations on the filesystem.