CVE-2025-60268: Huayi-tec JeeWMS RCE Vulnerability

CVE-2025-60268 Overview

CVE-2025-60268 is an arbitrary file upload vulnerability in JeeWMS version 20250820, a warehouse management system developed by Huayi-tec. The flaw resides in the saveFiles function within the /jeewms/cgUploadController.do endpoint, which fails to validate uploaded file types or content. An authenticated attacker with normal user privileges can upload a malicious file, such as a web shell, and achieve remote code execution on the underlying server. The weakness is tracked under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Authenticated attackers can upload malicious files through cgUploadController.do and execute arbitrary code on the JeeWMS host.

Affected Products

Huayi-tec JeeWMS version 20250820
Deployments exposing /jeewms/cgUploadController.do to authenticated users
Systems built from the upstream Gitee JEEWMS repository at the affected commit

Discovery Timeline

2025-10-10 - CVE-2025-60268 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60268

Vulnerability Analysis

JeeWMS exposes an upload handler at /jeewms/cgUploadController.do that invokes the saveFiles function to persist client-submitted files. The handler does not perform server-side validation of the file extension, MIME type, or magic bytes before writing the file to disk. Any account with standard privileges can therefore submit a request that stores executable server-side content, such as a JSP web shell, inside a web-accessible directory.

Because JeeWMS is built on a Java servlet stack, an attacker who places a .jsp file within the application's deployment path can request it through the web server and trigger execution in the JVM. This grants command execution under the privileges of the application server process. Requiring only low-privileged authentication and no user interaction, the flaw is well suited to post-compromise lateral movement or opportunistic abuse of exposed instances.

Root Cause

The root cause is missing file validation in the saveFiles method of cgUploadController. The controller trusts client-supplied filenames and content, does not enforce an allow-list of extensions, and writes files to a path where the servlet container will interpret executable resources.

Attack Vector

Exploitation follows a standard authenticated file upload chain. The attacker authenticates to JeeWMS, crafts a multipart POST request to /jeewms/cgUploadController.do targeting the saveFiles action, and attaches a malicious file with a server-executable extension. After upload, the attacker requests the file's URL, causing the servlet engine to execute the embedded payload. Further technical detail is available in the GitHub issue report and the Gitee project repository.

Detection Methods for CVE-2025-60268

Indicators of Compromise

New or unexpected .jsp, .jspx, or .war files appearing in JeeWMS upload directories after requests to cgUploadController.do
HTTP POST requests to /jeewms/cgUploadController.do from low-privileged accounts with multipart payloads containing script extensions
Java application server processes spawning shell interpreters such as sh, bash, or cmd.exe
Outbound connections initiated by the JeeWMS JVM to attacker-controlled infrastructure shortly after upload activity

Detection Strategies

Alert on writes of executable file extensions into any directory served by the JeeWMS web application
Correlate upload requests to cgUploadController.do with subsequent GET requests to the same filename that return HTTP 200
Baseline normal upload patterns per user and flag accounts uploading unusually large volumes or unfamiliar file types

Monitoring Recommendations

Enable verbose access logging on the JeeWMS servlet container and forward logs to a central SIEM
Monitor child processes of the Java application server for command shells or scripting interpreters
Track file integrity in the JeeWMS web root and raise alerts when new server-side scripts appear

How to Mitigate CVE-2025-60268

Immediate Actions Required

Restrict network access to /jeewms/cgUploadController.do at the reverse proxy or WAF layer, allowing only trusted internal users
Audit the JeeWMS web root and upload directories for unexpected .jsp, .jspx, or .war files and remove any that are not legitimate
Rotate credentials for any accounts that may have been used to test or exploit the upload endpoint
Review authentication logs for suspicious low-privileged sessions interacting with the upload controller

Patch Information

At the time of publication, no vendor advisory or patched release is listed in the NVD entry. Monitor the Gitee JEEWMS repository for commits that add server-side validation to the saveFiles function and apply updates as soon as they are released.

Workarounds

Configure the servlet container to deny execution of script files in upload directories by mapping them to a static content handler
Deploy a WAF rule that inspects multipart uploads to cgUploadController.do and blocks executable extensions and script signatures
Enforce least-privilege on JeeWMS accounts and disable interactive access for service accounts that do not require upload rights
Run the JeeWMS application server under a low-privileged OS user with no shell to limit the impact of code execution

bash

# Configuration example: deny script execution in JeeWMS upload paths (nginx reverse proxy)
location ~* ^/jeewms/.*/upload/.*\.(jsp|jspx|war|sh|py|php)$ {
    deny all;
    return 403;
}

location = /jeewms/cgUploadController.do {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://jeewms_backend;
}