CVE-2026-102366 in mall4j
Summary
by MITRE • 09/29/2026
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The identified security flaw resides within the mall4j framework version 4.0 and specifically targets the FileController endpoints responsible for handling file uploads. This vulnerability is classified as an unrestricted file upload issue, which fundamentally stems from a failure to implement adequate access control mechanisms combined with insufficient input validation on the server side. The core technical deficiency lies in the absence of authorization checks for these specific API endpoints, allowing any user possessing a valid authentication token to interact with them without restriction based on their privilege level or intended role within the application architecture. Furthermore, the system fails to perform rigorous type checking or content verification on the files being uploaded, thereby accepting arbitrary file types including executable script formats such as HTML and SVG documents that can contain embedded JavaScript code.
From a technical perspective, this vulnerability enables stored cross-site scripting attacks by allowing malicious actors to persistently inject client-side scripts into the application's storage infrastructure. When an attacker uploads a crafted HTML or SVG file containing malicious JavaScript payloads, these files are saved directly to the local server storage path without sanitization. Subsequently, when an administrator or any privileged user accesses this stored content through their browser, the embedded script executes within the context of that user's session. This execution environment grants the attacker the ability to perform actions on behalf of the victim, such as stealing sensitive cookies, session tokens, or other authentication credentials, thereby facilitating account takeover and further compromise of the application ecosystem.
The operational impact of this vulnerability is severe due to its potential for widespread data exfiltration and system manipulation. Because the attack relies on stored content rather than transient input like query parameters, it does not require complex social engineering tactics such as phishing links; instead, simply accessing a specific page or resource that renders the uploaded file can trigger the exploit. This persistence mechanism means that once the malicious payload is deployed, every subsequent access by an authorized user potentially re-triggers the attack vector until the compromised files are identified and removed from storage. The ability to execute scripts in administrator browsers significantly escalates the risk profile, as it allows attackers to bypass client-side security controls and interact directly with administrative functions of the mall4j platform.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-434 which describes unrestricted upload of file with dangerous type, highlighting the failure to restrict file types that can be uploaded to a system. Additionally, it maps to CWE-79 for Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting, specifically in its stored variant where malicious scripts are permanently stored on target servers. From an offensive security framework perspective, this attack vector corresponds to the MITRE ATT&CK technique T1059 which covers Command and Scripting Interpreter execution via web applications, demonstrating how attackers leverage application features to execute arbitrary code within trusted environments.
To mitigate this vulnerability, developers must implement strict authorization checks on all file upload endpoints ensuring that only users with appropriate privileges can initiate uploads or manage stored files. It is critical to enforce a whitelist approach for allowed file types rather than relying on blacklist methods which are prone to bypasses through obscure extensions or MIME type manipulation. Input validation should include both extension checking and deep content inspection using libraries capable of detecting malicious payloads within SVG or HTML structures, such as sanitizing DOM elements that can execute scripts. Additionally implementing Content Security Policy headers can help mitigate the impact by restricting script execution sources even if an injection occurs. Regular security audits and static code analysis focused on file handling logic are recommended to prevent similar flaws in future development cycles of the mall4j framework.