CVE-2026-102366

MEDIUM 4.4

mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.

CWE	CWE-434
Vendor	gz-yami
Product	mall4j
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for gz-yami mall4j

Be the first to know when new medium vulnerabilities affecting gz-yami mall4j are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

gz-yami / mall4j

0 ≤ 4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A03_admin_file_upload_xss.py github.com: https://github.com/gz-yami/mall4j github.com: https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/FileController.java#L44-L64 github.com: https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/java/com/yami/shop/service/impl/AttachFileServiceImpl.java#L62-L81 vulncheck.com: https://www.vulncheck.com/advisories/mall4j-through-4.0-unrestricted-file-upload-in-admin-file-endpoints

Credits

Mingsheng Lin