CVE-2026-102366

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1

Description The software contains an unrestricted file upload issue within the FileController endpoints. These endpoints lack proper authorization checks and fail to validate uploaded file types. An authenticated attacker can upload HTML or SVG files to the local storage path. When an administrator accesses these files, the uploaded scripts execute in their browser, leading to stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server.

Recommendations Update mall4j to a version later than 4.0. Restrict access to the FileController endpoints to authorized administrative users only. Implement strict validation for file types uploaded via FileController to block HTML and SVG files.