CVE-2025-5389: JeeWMS File generateController.do dogenerateOne2Many access control

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-31 · updated 2026-06-17
Weakness: CWE-266

Description

A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Affected products

erzhongxmu JEEWMS: through 2025-05-04

References

https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV
https://vuldb.com/?ctiid.310682
https://vuldb.com/?id.310682

Get alerted when CVE-2025-5389 or the next vulnerability affects your stack