Newbee Mall CVE-2026-94045

Requires an authenticated low-privileged user (PR:L) able to reach the Goods Save endpoint (controller/common/UploadController.java) to set goodsName or upload a file. Persistence depends on the deployment serving user uploads via the /upload/** static resource mapping and the ImageIO.read()-based 'image-only' validation being present (which is bypassable with a polyglot PNG carrying an <img onerror> HTML payload). Exploitation is limited by: required authentication, required victim interaction (UI:P - an admin/user must view the poisoned goods listing or uploaded resource for the payload to fire), and the niche demo-project deployment base. No unauthenticated path is indicated.

This is a low-to-moderate real-world risk that should not be over-prioritized despite public exploit availability. The vendor CVSS 4.0 score of 5.1 (PR:L/UI:P/VI:L, integrity-only) correctly frames it as a bounded stored-XSS issue: exploitation requires an authenticated actor with access to the Goods Save endpoint (PR:L) and a victim who subsequently loads the poisoned goods/upload content (UI:P). SSVC signals are mixed - exploitation is 'Proof of Concept' (E:P, a public POC exists via the vendor issue tracker) but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or automatable exploitation; this indicates opportunistic-at-best rather than widespread attack pressure. The description's technical note (ImageIO.read() being format-agnostic, allowing a polyglot PNG|<img onerror> payload past the 'image-only' guard, combined with attacker-controlled suffix and the /upload/** static mapping) meaningfully raises the practical impact from ephemeral reflected XSS to persisted XSS, but the confidentiality/integrity ceiling remains that of script execution in a browser session, not RCE. No signals conflict materially; the main caveat is that the affected product (newbee-mall) is a learning/demo project, which caps real-world exposure.

An attacker with a low-privileged authenticated account (e.g., a seller/merchant able to reach the Goods Save endpoint) submits a crafted goodsName value or uploads a polyglot image (a valid PNG that also contains an <img onerror> HTML payload) that passes the ImageIO.read() 'image-only' validation and is stored under the /upload/** static path with an attacker-influenced suffix. When an administrator or another user later views the goods listing or the uploaded resource, the payload executes in their browser context. A public POC exists (referenced in the vendor's GitHub issue #126), lowering the barrier to reproduction.