CVE-2026-75308 Details

A stored cross-site scripting vulnerability has been identified in Yshopmall versions through 3.3. The issue arises from the file upload endpoint '/api/upload', which lacks proper file type validation. This flaw allows attackers to upload files of any type, including HTML, JSP, and other executable formats. When the system is set to local storage mode, these files are saved on the server's local file system and can be accessed publicly without authentication. Exploiting this vulnerability involves uploading a malicious HTML file that executes scripts in the browser, as the uploaded files are served with their original content types, enabling the execution of embedded scripts.

Users are advised to implement strict file type validation, ensuring only safe file types are accepted. Additionally, validating file content to prevent extension spoofing, setting the 'Content-Disposition' header to force downloads instead of rendering files, using randomized filenames, and adding a 'Content-Security-Policy' header to restrict inline script execution can help mitigate this vulnerability. Finally, correcting the file upload endpoint's response to match the actual resource access path is essential.