CVE-2026-67688 Details

A vulnerability allowing unrestricted file uploads has been identified in ICS-Park Smart Park Management System version 2.0. The issue arises in the file upload module, where the allowed extension whitelist includes 'html' and 'htm' files. This vulnerability enables authenticated users to upload HTML files containing malicious JavaScript, which is executed when other users access the uploaded files. The uploaded files are stored in a directory that is publicly accessible as a static resource, facilitating the execution of the embedded scripts.

To address this vulnerability, remove 'html' and 'htm' from the DEFAULT_ALLOWED_EXTENSION whitelist, add Content-Type validation to ensure uploaded files match their extensions, and implement a Content Security Policy that prevents browsers from rendering uploaded HTML files. Additionally, store uploaded files outside the web root and serve them through a download controller that sets the Content-Type to application/octet-stream.