CVE-2026-75331

Name of the Vulnerable Software and Affected Versions tamguo version 1.5.3

Description An unrestricted file upload issue allows for stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within FileUploadController.java and UEditorController.java lack file type validation, enabling attackers to upload arbitrary HTML or JavaScript files to the server.

Recommendations Update tamguo version 1.5.3 to a version that implements strict file type validation for the '/uploadFile' and '/imgUpload' endpoints.