CVE-2026-75308

Deferred Deferred - Pending Action

Cross-Site Scripting (XSS) in yshopmall File Upload

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: MITRE

Description

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-75308

EUVD

EUVD-2026-75210

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

yshopmall version 3.3 or earlier has a Cross Site Scripting (XSS) vulnerability due to missing file type validation in the /api/upload endpoint. Attackers can upload malicious files like HTML or JSP files that execute scripts when accessed.

Detection Guidance

To detect this vulnerability, inspect the /api/upload endpoint for file uploads without proper validation. Check server logs for unusual file types like HTML, JSP, or executable files being uploaded. Monitor network traffic for POST requests to /api/upload with suspicious file extensions.

Impact Analysis

This vulnerability allows attackers to upload and execute malicious scripts in your browser when you access the uploaded files. This could lead to theft of cookies, session hijacking, or defacement of your website.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Immediately restrict file uploads to only allow specific, safe file types (e.g., images). Implement server-side validation to reject executable or script files. Update yshopmall to the latest version if a patched release is available. Consider disabling the /api/upload endpoint if not essential.

Hi! I’m here to help you understand CVE-2026-75308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70