{"id":"CVE-2025-7759","summary":"thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgery","details":"A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.","modified":"2026-08-12T15:32:38.026503Z","published":"2025-07-17T21:32:06.733Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7759.json","unresolved_ranges":[{"extracted_events":[{"introduced":"5.10"},{"last_affected":"5.10"},{"introduced":"5.11"},{"last_affected":"5.11"},{"introduced":"5.12.0"},{"last_affected":"5.12.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7759.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7759"},{"type":"ADVISORY","url":"https://vuldb.com/?id.316749"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.615769"},{"type":"REPORT","url":"https://github.com/thinkgem/jeesite5/issues/27"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.316749"},{"type":"FIX","url":"https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc"},{"type":"EVIDENCE","url":"https://github.com/MentalityXt/jeesite_ssrf/tree/main"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/thinkgem/jeesite","events":[{"introduced":"0"},{"fixed":"eeb530562393fb481690a8ef0cb3bb15503f29f0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.12.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:jeesite:jeesite:*:*:*:*:*:*:*:*"}},{"type":"GIT","repo":"https://github.com/thinkgem/jeesite5","events":[{"introduced":"53ceb352e0fef4195d97df5b397a9499b39bd123"},{"fixed":"1c5e49b0818037452148e0f8ff69ed04cb8fefdc"}],"database_specific":{"extracted_events":[{"introduced":"5.0"},{"last_affected":"5.0"},{"introduced":"5.1"},{"last_affected":"5.1"},{"introduced":"5.2"},{"last_affected":"5.2"},{"introduced":"5.3"},{"last_affected":"5.3"},{"introduced":"5.4"},{"last_affected":"5.4"},{"introduced":"5.5"},{"last_affected":"5.5"},{"introduced":"5.6"},{"last_affected":"5.6"},{"introduced":"5.7"},{"last_affected":"5.7"},{"introduced":"5.8"},{"last_affected":"5.8"},{"introduced":"5.9"},{"last_affected":"5.9"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","5.8","5.9","v5.12.0.vue","v5.9.1","v5.9.0","v5.8.1","v5.8.0","v5.7.1","v5.7.0","v5.6.0","v5.5.2","v5.5.1","v5.5.0","v5.4.0","v5.3.2","v5.3.1","v5.3.0","v5.2.2","v5.2.1","v5.2.0","v5.1.0","v5.0.4","v5.0.3","v5.12.0.springboo3","v5.11.1.springboo3","v5.11.0.springboo3","v5.10.1.springboo3","v5.10.0.springboot3","v5.9.2.springboot3","v5.9.1.springboot3","v5.0.2","v5.0.1","v5.0.0.1","v5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7759.json","vanir_signatures_modified":"2026-08-12T15:32:38Z","vanir_signatures":[{"digest":{"length":1490,"function_hash":"197298650004654717552343063793213839689"},"id":"CVE-2025-7759-43a7f2e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc","target":{"file":"modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java","function":"invoke"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc","target":{"file":"modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81837515418203944754595413661962474830","107201814600497962693269992140704497146","258976055338017258199931800960879961968","298372325623878408660816653703151093772","217301273048257232818296035623607681748","111320947540539556400283041793621005646","251579846703931908901076899073287535071","314177713896038309549330220940081335767","288724351273485516956261480966290011259","336519082650180822890925628776973153228","242533873804434210777033221325618715912","108642766051723238300997280874639075283","183113659526563990591453486362283092658","103599203092874443501793289881059267533"]},"id":"CVE-2025-7759-4f0623ce","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"83664895157502224164231868508667370897","length":137},"id":"CVE-2025-7759-62b605fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc","target":{"file":"modules/cms/src/main/java/com/jeesite/modules/cms/utils/FileTempleteUtils.java","function":"getFileTempleteByResource"}},{"digest":{"line_hashes":["193081477795829529326205095022135972125","296027688045524647021463395099376616322","144467921983520207169294161739528915120","259404669500789351583644640838553042667","290775352619989367666768335916912009052","211165538538588854636579088158278424532","21407655544056902127293706354281803633","50248755676210400290662782259126781289","212118207537023410478415109041872865552","269984662094728627967570026216414456393","309398996639749142591374671123978609789"],"threshold":0.9},"id":"CVE-2025-7759-d63645d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc","target":{"file":"modules/cms/src/main/java/com/jeesite/modules/cms/utils/FileTempleteUtils.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}