EUVD-2026-88026
GHSA-vmwc-7v5f-ffp7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryUpload file with bypassed MIME check
-
ExploitStore HTML/JS payload via upload endpoint
-
ExecutionVictim views uploaded content
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on StarTraining with access to the file Upload Endpoint (PR:L) and relies on the MimeTypeUtils.java MIME-type validation weakness that permits storing renderable HTML/script content. Exploitation further requires victim user interaction (UI:P) - a second user must view the malicious uploaded content for the script to execute. These factors (valid credentials, weak upload filtering, and a viewing victim) materially limit realistic exploitation beyond the network-reachable surface. |
| Impact | This is a low-real-risk issue despite being a network-exploitable stored XSS. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P/VC:N/VI:L/VA:N) shows the attacker needs valid authentication (PR:L) and victim interaction (UI:P), with only limited integrity impact and no confidentiality or availability impact - hence the very low 2.0 score. VulDB reports a public exploit (E:P), so publicly available exploit code exists, but there is no EPSS score and no CISA KEV listing, indicating no evidence of widespread or active exploitation - consistent with an obscure product. The vendor's VI:L-only scoring likely understates realistic impact: stored XSS in an admin/training panel can plausibly hijack another user's session (a confidentiality/integrity effect with scope change), so my independent assessment raises C to Low and treats it as scope-changed. Net: a genuine but minor flaw, not a priority given authentication + user-interaction prerequisites, tiny deployment footprint, and no active-exploitation signal. |
| Exploit ScenarioDerived | An authenticated low-privilege user of StarTraining uploads a file whose MIME type slips past MimeTypeUtils.java validation, causing HTML/JavaScript to be stored and later rendered. When another user (e.g. an administrator) views the uploaded content, the script executes in their browser session. A public proof-of-concept exists (ArrestX ST-VULN-006), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Stored cross-site scripting in zhistaredu StarTraining 3.8.1 and earlier lets an authenticated user upload a file whose MIME type is misclassified by MimeTypeUtils.java, so the content is stored and later rendered as HTML/script in a victim's browser; the attacker's script then executes in the context of the StarTraining web application. Exploitation requires a valid account with access to the Upload Endpoint plus a second user who views the uploaded content, and publicly available exploit code exists. This is a low-real-risk issue despite being a network-reachable stored XSS: the vendor was contacted but never responded, and no vendor-released patch has been identified, so the practical severity is bounded by the credential and user-interaction prerequisites.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was contacted early and did not respond - so remediation must be compensating-control driven. Until a fixed build appears, restrict the Upload Endpoint to the minimum set of trusted roles and disable anonymous or low-privilege uploads entirely (side effect: legitimate content contribution workflows stop). Harden server-side validation in MimeTypeUtils.java or its callers to enforce a strict extension and magic-byte allowlist (images/PDF/office only) and reject anything resembling HTML, SVG, or script, and never trust the client-supplied Content-Type (side effect: some legitimate file types will be refused and need explicit whitelisting). Force storage and delivery of user uploads with Content-Disposition: attachment plus a neutral type such as application/octet-stream or text/plain so browsers download rather than render them (side effect: inline preview of uploaded documents breaks). Where feasible, serve all user-uploaded content from a separate cookieless origin or sandboxed domain and add a restrictive Content-Security-Policy with script-src 'self' to contain any residual injection (side effects: cross-origin integration work plus possible breakage of legitimate inline scripts). Track the upstream advisory at https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-006-stored-html-upload-xss.md and https://vuldb.com/vuln/410810 for a vendor fix, and monitor upload/log activity for HTML-bearing files in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS rooted in the mime-type inspection logic in du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java. The utility is intended to map uploaded files to a safe MIME type, which the application then uses to decide how the object is served back. Because the validation permits content that browsers will render as text/html or otherwise execute as script, an uploaded file survives storage and is later delivered to other users with an executable content type - the classic upload-endpoint-to-stored-XSS chain (closely related to CWE-434, unrestricted upload). The affected surface is Java-based, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, with E:P indicating public exploit code) confirms the network-reachable, authenticated, victim-interaction-dependent nature of the flaw. Our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores the scope change and low confidentiality/integrity impact but no availability impact, consistent with a script-injection issue rather than server compromise. No CPE identifiers were supplied, so the exact build strings are unverified beyond the stated 'up to 3.8.1' range.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated upload (PR:L) and victim must view content (UI:R); stored XSS executes in another user's browser context so scope changes (S:C) with limited confidentiality/integrity, no availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB