A flaw exists in thinkgem JeeSite up to version 5.15.1 within the CasOutHandler endpoint, allowing an attacker to manipulate XML input so that an external entity reference is resolved. This XXE flaw can expose internal resources or cause denial of service by forcing the application to access arbitrary files or URLs. Because the exploit can be performed remotely, an attacker could trigger the vulnerability from outside the network, though the complexity of the attack is considered high and the exploit is difficult to execute. The vulnerability does not provide direct code execution or privilege escalation, but it does enable data disclosure or resource exhaustion in the affected system.

thinkgem JeeSite versions up through 5.15.1 are affected. The flaw resides in the CasOutHandler component exposed via the endpoint /com/jeesite/common/shiro/cas/CasOutHandler.java.

The CVSS score of 2.3 indicates low severity, and the EPSS score being less than 1% shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known malicious use at present. However, because the exploit has been published and is remotely reachable, organizations running vulnerable versions should consider upgrading or applying mitigations promptly.