Vulnerability · Published Sep 28, 2026 · Assigned by VulnCheck
CVE-2026-102366mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
Medium 4.4
In plain English
A medium-severity unrestricted file upload in mall4j from gz-yami. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A03_admin_file_upload_xss.py exploit
- https://github.com/gz-yami/mall4j product
- https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/FileController.java#L44-L64 technical-description
- https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/java/com/yami/shop/service/impl/AttachFileServiceImpl.java#L62-L81 technical-description
- VulnCheck Advisory: mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints third-party-advisory