CVE-2026-102366 — mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validati…
Published: 2026-09-28 · CVSS: 2.1 · CVSS 4.0
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7