CVE-2025-8764: Linlinjava Litemall RCE Vulnerability

CVE-2025-8764 Overview

CVE-2025-8764 is an unrestricted file upload vulnerability in linlinjava litemall through version 1.8.0. The flaw resides in the Upload function handling requests to the /wx/storage/upload endpoint. An authenticated remote attacker can manipulate the File argument to upload arbitrary files. The issue is tracked as CWE-284: Improper Access Control. Exploit details have been publicly disclosed, though no weaponized exploit is currently indexed in Exploit-DB or the CISA KEV catalog.

Critical Impact
Remote attackers with low-privilege access can upload arbitrary files to the litemall storage endpoint, enabling potential webshell staging and downstream code execution scenarios.

Affected Products

linlinjava litemall versions up to and including 1.8.0
The Upload function within /wx/storage/upload
Deployments exposing the WeChat mini-program (/wx) API surface

Discovery Timeline

2025-08-09 - CVE-2025-8764 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8764

Vulnerability Analysis

litemall is an open-source Java-based e-commerce platform combining Spring Boot, Vue, and WeChat mini-program components. The /wx/storage/upload endpoint accepts file uploads from the WeChat client-side interface. The endpoint fails to enforce restrictions on the File parameter, allowing attackers to submit files of arbitrary type, extension, or content.

Because the endpoint does not validate MIME type, extension allow-lists, or file magic bytes, an attacker holding valid low-privilege credentials can upload executable content. The uploaded files are stored in a location reachable through the application's static resource handler. Attackers can then request the stored artifact directly.

The issue is categorized under CWE-284: Improper Access Control, reflecting missing constraints on who may upload and what content is accepted.

Root Cause

The root cause is missing input validation and access enforcement inside the Upload handler. The function trusts the caller-supplied File argument without verifying file type, size, or authorization scope. Public discussion of the flaw appears in GitHub Litemall Issue #567.

Attack Vector

Exploitation proceeds over the network against an exposed litemall instance. The attacker authenticates to obtain the low-privilege session required by the WeChat API layer. The attacker then issues a multipart POST request to /wx/storage/upload with a malicious payload as the File field. On successful upload, the server returns a storage URL that references the attacker-controlled artifact. See the VulDB entry #319266 for additional technical context.

No verified proof-of-concept code is included in the public disclosure. Practitioners should refer to the linked advisories for reproduction details.

Detection Methods for CVE-2025-8764

Indicators of Compromise

POST requests to /wx/storage/upload originating from unexpected source IPs or user-agents
New files with executable extensions (.jsp, .jspx, .war, .sh) appearing in the litemall storage directory
Outbound network connections initiated by the litemall JVM process shortly after upload events
Unusual growth in the storage directory volume tied to a single authenticated account

Detection Strategies

Inspect application access logs for anomalous /wx/storage/upload request rates and non-image content-types
Correlate upload events with subsequent GET requests to the returned storage URL to detect execution attempts
Deploy file integrity monitoring on the litemall storage path to flag non-media file writes

Monitoring Recommendations

Forward litemall application and reverse-proxy logs into a centralized SIEM for retention and correlation
Alert on JVM child process creation, which is anomalous for a normal e-commerce workload
Monitor for outbound connections to uncommon destinations from the litemall host, indicating post-upload callback activity

How to Mitigate CVE-2025-8764

Immediate Actions Required

Restrict network exposure of the /wx/storage/upload endpoint to trusted client IPs where feasible
Enforce an allow-list of permitted MIME types and file extensions at the reverse proxy or WAF layer
Rotate credentials for any accounts observed exercising the vulnerable endpoint
Audit the litemall storage directory for unexpected files created since deployment

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Track the upstream project via GitHub Litemall Issue #567 for remediation progress. Organizations running litemall 1.8.0 or earlier should apply compensating controls until a fixed release is available.

Workarounds

Place the litemall storage path behind a rule that disables script execution for uploaded content
Configure the web server to serve the storage directory with a static Content-Type and X-Content-Type-Options: nosniff
Introduce server-side validation that rejects uploads whose magic bytes do not match declared image types
Require elevated authorization checks in the Upload handler before accepting file writes

bash

# Nginx example: block script execution and enforce content-type on the storage path
location /wx/storage/ {
    default_type application/octet-stream;
    add_header X-Content-Type-Options "nosniff" always;
    location ~* \.(jsp|jspx|war|php|sh|py|pl)$ {
        deny all;
    }
}