Path Traversal in JeeSite File Upload Parameter

An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-36760 is a critical path traversal vulnerability affecting JeeSite v5.15.1's file upload functionality. An authenticated attacker with file upload permissions can manipulate the fileMd5 parameter in the /a/file/upload endpoint to write arbitrary files to unintended filesystem locations, bypassing security controls through whitelisted file suffixes. This vulnerability is particularly dangerous because it requires only basic authentication rather than privileged access, making it exploitable by low-privilege users. Organizations running JeeSite v5.15.1 with chunked upload enabled face immediate risk of arbitrary file write attacks that could lead to remote code execution, configuration tampering, or lateral movement within their infrastructure.

Casky's 331 mapped skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Discovery (TA0007) tactics. Practitioners using Casky would see detection of CWE-22 path traversal indicators—specifically anomalous file path traversals using directory traversal sequences (../, ..\ patterns) in upload parameters, suspicious file writes to system-critical directories outside intended upload locations, and whitelisted file suffix abuse where attackers chain safe extensions with path manipulation. The platform's skill mapping would flag reconnaissance activities (TA0007) where attackers probe file upload endpoints and permissions, followed by exploitation attempts (TA0001) involving crafted fileMd5 parameters. Practitioners would receive findings highlighting the specific parameter manipulation technique and recommended detection rules focused on monitoring the /a/file/upload endpoint for path traversal payloads and unauthorized filesystem writes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-36760.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-36760

Casky has 331 skills that investigate the attack patterns behind CVE-2026-36760. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn