EUVD-2026-88582
GHSA-ffmx-jjx9-c9cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated upload (PR:L) over network, admin must open the file (UI:R); stored XSS crosses into the admin browser context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
AnalysisAI
Stored cross-site scripting in mall4j through 4.0 arises from unrestricted file uploads in admin FileController endpoints that require only any valid authenticated token and do not validate uploaded file types. An authenticated attacker can upload HTML or SVG files that execute script in an administrator's browser when the administrator opens the uploaded file from the local storage path, and publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated token to the mall4j admin backend (PR:L) - the FileController upload endpoints lack authorization checks, so any authenticated user, not just admins, can reach them. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is modest despite the availability of public exploit code. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the provided advisory data, so upgrade to a fixed mall4j release if one becomes available and validate that the FileController endpoints enforce authorization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today