CVE-2025-5385 is a Medium severity flaw (CVSS 6.3) in JeeWMS, an open source warehouse management system, in the function doAdd of /cgformTemplateController.do?doAdd. The weakness is path traversal. The product has no version numbers, so the record cannot name a fixed release. Treat it as unpatched.
What's affected
The record says JeeWMS is affected "up to 20250504", a date and not a release number. The product uses rolling releases and does not use versioning, so the record states that details of affected and updated releases are not available.
The affected function is doAdd, reached through /cgformTemplateController.do?doAdd. The record rates the attack as remote.
Several JeeWMS records published on the same day, within CVE-2025-5384 to CVE-2025-5390, cite the same project issue, so one deployment can carry more than one of these weaknesses.
How to check if you're exposed
Work out which snapshot of JeeWMS you run. Because there are no release numbers, compare your code to the date in the record:
git log -1 --format=%cd
grep -rn "cgformTemplateController" src/ | head
If your build is dated 4 May 2025 or earlier, assume it is affected. Then look in the web server logs for requests to the path in the record from addresses you do not expect, and check whether the path is reachable from outside your network.
What to do now
- Restrict the JeeWMS web interface to trusted networks, using a VPN or an IP allow list, until you have a fix you can verify.
- Block or require authentication for the path /cgformTemplateController.do?doAdd at the reverse proxy, if your workflow does not depend on it.
- Review the project issue linked in the record and compare your code with any later commits the maintainers publish.
- Run the application database account with minimum privileges, and keep backups you have tested.
- Record the exposure in your risk register, and plan a migration if the maintainers do not publish a fix.
Why it matters
The weakness is CWE-22, path traversal. A file path built from user input can point outside the folder the programmer intended, which can expose or overwrite files on the server.
The usual defences are to resolve the final path and check it sits inside an allowed directory, and to refuse names that contain path separators. Both are small changes, but the record shows no confirmed fix for this build.
Quick check
Which JeeWMS version fixes this?
None is named. JeeWMS uses rolling releases without version numbers, so check your code against the project issue and any later commits, and treat older builds as affected.
Is this on the CISA Known Exploited list?
No. The record is not flagged in the CISA catalogue. Limit exposure anyway, because the weakness is remotely reachable per the record.
Sources
Last reviewed: 18 October 2026.
