CVE-2026-94045
newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-79 CWE-94 |
| Vendor | newbee-ltd |
| Product | newbee-mall |
| Published | Sep 20, 2026 |
Get instant alerts for newbee-ltd newbee-mall
Be the first to know when new low vulnerabilities affecting newbee-ltd newbee-mall are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R