A flaw in the Connection Handler of thinkgem JeeSite allows an attacker to manipulate a request and traverse directories to read files outside the intended web root. The vulnerability resides in a function whose details are not publicly disclosed, but the exploitation path leverages path–traversal tokens such as "../". Because the attack can be performed remotely and the vulnerability is not limited to local users, the primary consequence is the potential disclosure of sensitive files, including configuration data or source code.

thinkgem JeeSite versions up to and including 5.15.1 are affected. The vulnerability applies to all installations using the default Connection Handler endpoint without additional access controls. No later versions are listed as vulnerable.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score of less than 1% suggests a very low probability that the flaw will be actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating low public exploitation activity. However, because the attack vector is remote, an attacker with network connectivity to the target could attempt to exploit the path traversal to read arbitrary files if the server permits the traversal. The attack requires high complexity and difficult exploitation, but once executed the impact is limited to information disclosure rather than full system compromise.