CVE-2025-5387 is a Medium severity flaw (CVSS 6.3) in JeeWMS, an open source warehouse management system, in the function dogenerate of /generateController.do?dogenerate. The weakness is improper access control in the File Handler component. The product has no version numbers, so the record cannot name a fixed release. Treat it as unpatched.
What's affected
The record says JeeWMS is affected "up to 20250504", a date and not a release number. The product uses rolling releases and does not use versioning, so the record states that details of affected and updated releases are not available.
The affected function is dogenerate, reached through /generateController.do?dogenerate. The record rates the attack as remote.
Several JeeWMS records published on the same day, within CVE-2025-5384 to CVE-2025-5390, cite the same project issue, so one deployment can carry more than one of these weaknesses.
How to check if you're exposed
Work out which snapshot of JeeWMS you run. Because there are no release numbers, compare your code to the date in the record:
git log -1 --format=%cd
grep -rn "generateController" src/ | head
If your build is dated 4 May 2025 or earlier, assume it is affected. Then look in the web server logs for requests to the path in the record from addresses you do not expect, and check whether the path is reachable from outside your network.
What to do now
- Restrict the JeeWMS web interface to trusted networks, using a VPN or an IP allow list, until you have a fix you can verify.
- Block or require authentication for the path /generateController.do?dogenerate at the reverse proxy, if your workflow does not depend on it.
- Review the project issue linked in the record and compare your code with any later commits the maintainers publish.
- Run the application database account with minimum privileges, and keep backups you have tested.
- Record the exposure in your risk register, and plan a migration if the maintainers do not publish a fix.
Why it matters
The weakness is CWE-266 (incorrect privilege assignment) and CWE-284 (improper access control). The component named in the record, the File Handler, does not enforce who may use it strongly enough.
Access control bugs do not need clever input. They happen when a function that should check the caller simply does not. The fix is a server side check on every request, not a hidden menu item.
Quick check
Which JeeWMS version fixes this?
None is named. JeeWMS uses rolling releases without version numbers, so check your code against the project issue and any later commits, and treat older builds as affected.
Is this on the CISA Known Exploited list?
No. The record is not flagged in the CISA catalogue. Limit exposure anyway, because the weakness is remotely reachable per the record.
Sources
Last reviewed: 18 October 2026.
