Unrestricted File Upload in mall4j Affects HTML and SVG Files
CVE-2026-102366

2.1LOW

Key Information:

Vendor

Gz-yami

Status
Mall4j
Vendor
CVE Published:
28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102366?

A vulnerability in mall4j prior to version 4.0 allows authenticated users to perform unrestricted file uploads through the FileController endpoints. This weakness occurs due to a lack of authorization checks and insufficient file type validation. Consequently, attackers can upload malicious HTML or SVG files that can execute JavaScript code in the browsers of users accessing these files from local storage, leading to potential stored cross-site scripting (XSS) incidents. It is crucial for administrators of affected systems to implement stringent security measures to prevent exploitation.

Affected Version(s)

mall4j 0 <= 4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102366 - Proof of Concept

References

https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f...
exploit
https://github.com/gz-yami/mall4j
product
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce0...
technical-description

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingsheng Lin
.