JeeWMS: Unauthenticated path traversal in file download endpoint
Summary
JeeWMS, an open-source warehouse management system, contains an unauthenticated path traversal flaw in the endpoint /systemController/showOrDownByurl.do. Remote attackers can send crafted GET requests with ../ sequences in the dbPath parameter to bypass the authentication interceptor and read arbitrary files on the server, for example win.ini or /etc/passwd. No login or user interaction is required, but the attacker needs network access to the application.
Affected
- JeeWMS builds from commit 194f221776cfcfd838abab7107b1a8352ea2bc59 up to, but excluding, commit 0a610e8178a0a1197e9c6615b58faf67c406d2bc (according to VulnCheck)
- Release versions: Unknown.
Fixed in
- Upstream fix: commit 0a610e8178a0a1197e9c6615b58faf67c406d2bc in the erzhongxmu/JeeWMS repository.
- Vendor advisory: Unknown.
- Fixed release version: Unknown. Confirm with the vendor which release contains this commit.
Workaround
- No official workaround is known.
- Block or restrict external access to the /systemController/ path at the reverse proxy or web application firewall.
- Review web server logs for requests to showOrDownByurl.do with unusual dbPath values.
Exploitation
- Public proof-of-concept write-ups and a Nuclei detection template exist.
- Exploitation in the wild: Conflicting information. VulnCheck lists the flaw in its KEV feed, while HOL states that current sources do not mark it as known exploited. No CISA KEV entry was found.
- A reported first exploitation observation by Shadowserver on 2023-10-17 could not be verified.
- CVSS scores differ by source: 8.7 (CVSS 4.0, provided), 7.5 (CVSS 3.1 by some sources), 5.3 (VulDB).
Our recommendation
- Check whether any JeeWMS instance is in use, especially any reachable from the internet.
- Restrict access to the application or the affected path until a fixed build is confirmed.
- Obtain the fixed release from the vendor or maintainers and verify that it includes commit 0a610e8.
- Review logs for requests to showOrDownByurl.do and check for signs of file disclosure.
- Rotate credentials and secrets if a vulnerable instance was publicly reachable.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 0a610e8 (erzhongxmu/JeeWMS) github.com
- VulnCheck advisory: JeeWMS Path Traversal via showOrDownByurl.do www.vulncheck.com
- Nuclei template jeewms-lfi.yaml github.com
- MrWQ vulnerability paper (JeeWMS) github.com
- VulDB entry 425264 vuldb.com
- Goby PoC: JeeWMS Arbitrary File Read github.com
- JeeWMS repository (erzhongxmu) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:51.
Original description (NVD)
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
NVD references (5)
- https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/JEEWMS_%E4%BB%93%E5%BA%93%E7%AE%A1%E7%90%86%E7%B…
- https://github.com/erzhongxmu/JeeWMS/commit/0a610e8178a0a1197e9c6615b58faf67c406d2bc
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/jeewms-lfi.yaml
- https://github.com/tzwlhack/Vulnerability/blob/main/JEEWMS%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6…
- https://www.vulncheck.com/advisories/jeewms-path-traversal-via-showordownbyurl-do
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.