The vulnerability exists in the fileMd5 parameter of the /a/file/upload endpoint in JeeSite 5.15.1. Authenticated users with file‑upload permissions can exploit a path traversal flaw to write arbitrary files that have whitelisted suffixes to any location on the server when chunked upload is enabled. This allows an attacker to overwrite application files or place malicious scripts, potentially enabling remote code execution or unauthorized configuration changes. The weakness corresponds to a path traversal error (CWE‑22).

The flaw is present in installations of JeeSite version 5.15.1 that expose the /a/file/upload endpoint and allow authenticated file uploads while chunked upload is enabled. No other JeeSite versions or products are indicated as affected.

Exploitation requires the attacker to be authenticated and possess file‑upload rights, so the attack surface is limited to privileged users. Nevertheless, the ability to write to arbitrary disk locations enables modifying critical code or deploying web shells. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.6 indicates high risk, and the potential to tamper with application files. No public exploit has been reported yet.