tamguo CVE-2026-75331

Exploitation requires a valid low-privilege authenticated session (PR:L from CVSS vector) - unauthenticated access to the upload endpoints is not indicated. Additionally, a victim user must be induced to navigate to or load the uploaded malicious file in their browser (UI:R), meaning this is not a self-executing exploit and requires a social engineering step. The affected endpoints are /uploadFile and /imgUpload, which must be accessible and functional in the deployment. Exploitation is limited to tamguo 1.5.3 specifically; no other versions are confirmed vulnerable. There is no confidentiality or availability impact on the server itself - impact is confined to the browser session of the victim user.

The provided CVSS 3.1 score of 4.6 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N accurately reflects the constrained real-world risk. The PR:L metric confirms exploitation requires authenticated access, and UI:R means a victim must be induced to load the uploaded file - two meaningful barriers that reduce opportunistic exploitation risk significantly. EPSS of 0.14% at the 3rd percentile corroborates this: exploitation is theoretically straightforward but the product's niche footprint suppresses observed exploitation activity. The vulnerability is not listed in CISA KEV. A GitHub-hosted CVE writeup exists at the referenced link, suggesting a researcher has documented the flaw (possible proof-of-concept), but this is not confirmed as weaponized exploit code. The stored nature of the XSS elevates persistence risk over reflected XSS. Overall, this is a genuine but low-priority finding whose practical impact is bounded by the product's limited deployment and the authentication prerequisite.

An attacker with a low-privilege account on tamguo 1.5.3 uploads a file named payload.html containing a JavaScript cookie-stealing script via the /imgUpload endpoint. The attacker then sends a crafted link to the stored file to an administrator or higher-privileged user; when the victim opens the link in their browser, the script executes in the application's origin context, exfiltrating session cookies or credentials to an attacker-controlled server. A researcher-authored CVE writeup exists on GitHub, suggesting this attack pattern has been documented and could be replicated.