CVE-2026-90500
Received Received - Intake

Unrestricted File Upload in lenve vhr 1.0-SNAPSHOT

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90500
EUVD
EUVD-2026-76973

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in the vhr application version 1.0-SNAPSHOT. It affects the FastDFSUtils.upload function in the Avatar Upload component. The issue allows any logged-in user to upload files with arbitrary extensions without proper validation of MIME types or file extensions. Attackers can exploit this by uploading malicious SVG files containing JavaScript code, which may lead to stored cross-site scripting (XSS) if the file is served from FastDFS or a CDN.

Detection Guidance

Check for uploaded files with unusual extensions like SVG in the /hr/userface directory. Look for files uploaded via the Avatar Upload feature in lenve vhr 1.0-SNAPSHOT. Inspect FastDFSUtils.upload() function calls for missing file type validation.

Impact Analysis

An attacker could upload a malicious file that executes JavaScript when accessed, potentially stealing user sessions, defacing web pages, or spreading malware. If the uploaded file is served from a CDN or the application, it could affect other users interacting with the system. The impact includes unauthorized code execution, data theft, and compromised user trust.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data, which violates GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, and reputational damage due to inadequate safeguards against unauthorized file uploads and potential XSS attacks.

Mitigation Strategies

Implement strict file extension whitelisting for uploads. Validate file magic bytes to ensure correct file types. Strip scripts from SVG files before processing. Ensure FastDFSUtils.upload() includes proper MIME type and extension checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90500. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart