Unrestricted File Upload in mall4j Leads to Stored XSS

Executive Summary

CVE-2026-102366 is an unrestricted file upload vulnerability in the mall4j e-commerce platform (versions 4.0 and earlier). It affects admin file-upload endpoints that lack authorization checks. Attackers with any authenticated token can upload arbitrary files, including HTML or SVG files, without validation. When stored locally, these files execute scripts in administrator browsers, enabling stored cross-site scripting (XSS) attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your mall4j instance has endpoints POST /admin/file/upload/element or POST /admin/file/upload/tinymceEditor without authorization checks. Inspect FileController.java for missing @PreAuthorize annotations. Verify if AttachFileServiceImpl#uploadFile allows arbitrary file uploads without extension or content-type validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to upload malicious files that execute scripts in admin browsers. This could lead to session hijacking, unauthorized access to admin accounts, or further compromise of the system. Even basic authenticated tokens (like shopper accounts) can be exploited to upload files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive admin data, potentially leading to data breaches. GDPR and HIPAA require protecting personal and health data, respectively. A successful XSS attack could expose such data, resulting in regulatory penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade mall4j to a version beyond 4.0. Add @PreAuthorize annotations to FileController endpoints to enforce admin authorization. Implement strict file extension whitelists and content-type validation in AttachFileServiceImpl#uploadFile. Disable local storage uploads if not required or restrict access to uploaded files.

Useful 0 Not Useful 0