CVE-2026-2146: yshopmall File Upload RCE Vulnerability

CVE-2026-2146 Overview

A security flaw has been discovered in guchengwuyue yshopmall up to version 1.9.1. This vulnerability affects the updateAvatar function within the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. By manipulating the File argument, an attacker can perform unrestricted file uploads. The attack can be carried out remotely over the network. The exploit has been publicly disclosed, and the project maintainers were informed early through an issue report but have not yet responded.

Critical Impact

Remote attackers with low privileges can upload arbitrary files to the server, potentially leading to remote code execution, server compromise, or other malicious activities.

Affected Products

• guchengwuyue yshopmall up to version 1.9.1
• Component: co.yixiang.utils.FileUtil
• Endpoint: /api/users/updateAvatar

Discovery Timeline

• 2026-02-08 - CVE-2026-2146 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2146

Vulnerability Analysis

This vulnerability is classified as an Improper Access Control issue (CWE-284), specifically manifesting as an unrestricted file upload vulnerability. The flaw exists in the avatar update functionality of the yshopmall e-commerce platform. The updateAvatar function in co.yixiang.utils.FileUtil fails to properly validate or restrict the types of files that can be uploaded through the /api/users/updateAvatar endpoint.

When users attempt to update their profile avatar, the application does not implement adequate controls to verify the file type, content, or extension. This allows authenticated attackers to upload potentially malicious files, including web shells, executable scripts, or other dangerous content that could compromise the server.

Root Cause

The root cause stems from improper access control and missing input validation in the file upload handling mechanism. The updateAvatar function accepts the File argument without sufficient checks on:

• File type and MIME type validation
• File extension whitelisting
• File content inspection
• Upload path sanitization

This allows attackers to bypass intended restrictions and upload files that should not be permitted in an avatar upload context.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker with low-level privileges (authenticated user) can craft a malicious HTTP request to the /api/users/updateAvatar endpoint with a manipulated file parameter. The attack requires no user interaction and can be automated.

The attack flow involves:

1. Authenticating to the yshopmall application with valid credentials
2. Crafting a multipart form request to the avatar update endpoint
3. Manipulating the file parameter to upload malicious content (e.g., a web shell)
4. Accessing the uploaded file to execute arbitrary code on the server

For technical details on the vulnerability mechanics, refer to the GitHub Issue Discussion where the vulnerability was originally reported.

Detection Methods for CVE-2026-2146

Indicators of Compromise

• Unusual file types appearing in avatar or upload directories (e.g., .jsp, .php, .sh, .exe files)
• Unexpected HTTP requests to the /api/users/updateAvatar endpoint with non-image file content
• Web shells or script files with recent creation timestamps in web-accessible directories
• Unusual outbound network connections from the web server

Detection Strategies

• Monitor HTTP POST requests to /api/users/updateAvatar for suspicious file extensions or MIME types
• Implement file integrity monitoring on upload directories to detect unauthorized file additions
• Review web server logs for access attempts to newly uploaded files with executable extensions
• Deploy web application firewalls (WAF) with rules to detect file upload abuse patterns

Monitoring Recommendations

• Enable detailed logging for the file upload functionality and avatar update operations
• Set up alerts for file uploads that don't match expected image formats (JPEG, PNG, GIF)
• Monitor server resource usage for signs of malicious script execution
• Implement regular scans of upload directories for suspicious files

How to Mitigate CVE-2026-2146

Immediate Actions Required

• Restrict access to the /api/users/updateAvatar endpoint until a patch is available
• Implement server-side file type validation based on content inspection, not just file extension
• Configure web server to prevent execution of scripts in upload directories
• Review and clean upload directories for any suspicious files

Patch Information

As of the last update on 2026-02-09, no official patch has been released by the project maintainers. The GitHub issue reporting the vulnerability has not received a response from the developers. Organizations using yshopmall should monitor the project repository for updates and consider implementing the workarounds below until an official fix is available.

Workarounds

• Implement a web application firewall (WAF) rule to validate file uploads and block non-image file types
• Add server-side validation in the FileUtil class to whitelist only image file extensions (.jpg, .jpeg, .png, .gif)
• Configure the web server to disable script execution in the upload directory using directives like php_flag engine off or equivalent
• Implement content-type validation by inspecting file magic bytes rather than relying on client-provided MIME types
• Consider removing or disabling the avatar upload functionality until a proper fix is implemented

# Example: Disable script execution in Apache upload directory
# Add to .htaccess in the upload directory

# Deny execution of scripts
<FilesMatch "\.(php|jsp|asp|aspx|sh|cgi|pl|py)$">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP engine entirely
php_flag engine off