An authenticated user with file upload rights can manipulate the fileEntityId parameter in JeeSite's /a/file/upload endpoint to inject directory traversal characters. This allows writing files with approved suffixes to any location on the server’s filesystem. Based on the description, it is inferred that this is a Path Traversal weakness (CWE‑22). The result is full control over file creation and replacement, leading to potential configuration tampering, deployment of malicious code, and compromise of application integrity and confidentiality.

JeeSite version 5.15.1 is affected. No other versions are listed as impacted.

The vulnerability has a CVSS score of 8.8, indicating high severity due to the ability to write arbitrary files once authenticated. The EPSS score is less than 1%, and the entry is not listed in CISA's KEV catalog, indicating no documented exploitation yet. The likely attack vector requires authentication with file upload permissions and the ability to send crafted HTTP requests to the /a/file/upload endpoint. If exploited, the attacker could replace critical application files or deploy malicious resources, effectively gaining remote code execution potential depending on the server configuration.