CVE-2026-3405
Published: 02 March 2026
Description
A vulnerability has been found in thinkgem JeeSite up to 5.15.1. The affected element is an unknown function of the component Connection Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The attack is…
more
considered to have high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents path traversal exploitation by validating and sanitizing user-supplied inputs to the Connection Handler component.
Identifies, reports, and remediates the specific path traversal flaw in JeeSite versions up to 5.15.1, including applying patches or workarounds.
Enforces access control policies to restrict unauthorized file reads even if path traversal inputs bypass initial checks.
Security SummaryAI
CVE-2026-3405 is a path traversal vulnerability (CWE-22) affecting thinkgem JeeSite versions up to 5.15.1. The issue resides in an unknown function within the Connection Handler component, where manipulation enables traversal beyond intended directories. Published on 2026-03-02, it carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
A remote attacker with low privileges can exploit this vulnerability over the network, though it demands high attack complexity, rendering exploitability difficult. Successful exploitation yields limited confidentiality impact, such as reading restricted files, with no effects on integrity or availability.
VulDB advisories note that the vendor was contacted early about the disclosure but provided no response. A proof-of-concept exploit has been publicly disclosed and may be usable, with references including VulDB entries and a Yuque document for further details. No patches or mitigations are specified.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in public-facing web application (JeeSite) enables exploitation of public-facing application (T1190) and facilitates reading restricted files from the local system (T1005).