CVE-2025-60268: Command Injection

Published Oct 10, 2025

Updated

An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code execution.

Affected Software

2 affected components

Jeewms JeeWMS

Huayi-tec Jeewms=2025-08-20

Event History

Oct 10, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60268?

CVE-2025-60268 has a high severity due to its potential for remote code execution through arbitrary file upload.

How do I fix CVE-2025-60268?

To fix CVE-2025-60268, ensure that file uploads are properly validated to prevent malicious file uploads.

What versions of JeeWMS are affected by CVE-2025-60268?

CVE-2025-60268 affects JeeWMS version 20250820.

What is the impact of exploiting CVE-2025-60268?

Exploiting CVE-2025-60268 allows an attacker to upload a malicious file, which can lead to complete system compromise.

Who can exploit the CVE-2025-60268 vulnerability?

An attacker with normal user privileges can exploit CVE-2025-60268 to perform arbitrary file uploads.