CVE-2026-75308: yshopmall XSS File Upload Vulnerability

CVE-2026-75308 Overview

CVE-2026-75308 affects yshopmall versions 3.3 and earlier. The application's file upload endpoint /api/upload lacks file type validation. Attackers can upload arbitrary file types, including HTML and JSP files, leading to stored Cross-Site Scripting (XSS) and potential server-side code execution.

The vulnerability stems from missing input validation on uploaded file extensions and content types. Any authenticated or unauthenticated caller (depending on deployment) reaching the upload endpoint can place executable content on the server. See the GitHub Issue Discussion for reproduction details.

Critical Impact
Unrestricted file upload allows attackers to store malicious HTML or JSP payloads, enabling XSS against users and potential remote code execution when JSP files are served by the application container.

Affected Products

yshopmall versions 3.3 and earlier
Deployments exposing the /api/upload endpoint
Java servlet containers hosting yshopmall JSP handlers

Discovery Timeline

2026-09-09 - CVE-2026-75308 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75308

Vulnerability Analysis

The yshopmall application exposes /api/upload for handling file submissions. The endpoint accepts uploaded files without verifying extension, MIME type, or content signature. This classifies as an Unrestricted File Upload leading to Cross-Site Scripting (XSS) [CWE-79] and potential code execution [CWE-434].

An attacker submits an HTTP POST request containing a file with a chosen extension. The server stores the file and returns a URL that references the uploaded artifact. When a victim retrieves an uploaded HTML file, the browser renders attacker-controlled scripts in the origin of the yshopmall application.

JSP file uploads compound the impact. Servlet containers such as Tomcat compile and execute JSP files on request. An attacker who can place a JSP file into a servable directory obtains code execution under the application's process identity.

Root Cause

The upload handler omits allow-list validation of file extensions and content types. It also fails to enforce storage paths that prevent execution by the servlet container. The combination permits attacker-controlled content to be both served and executed.

Attack Vector

An attacker crafts a multipart HTTP POST request targeting /api/upload with a malicious file such as payload.html or shell.jsp. The server accepts the file and returns its retrievable path. The attacker then distributes the URL to trigger XSS or requests the JSP file directly to invoke server-side execution.

Refer to the GitHub Issue Discussion for a working proof-of-concept and request structure.

Detection Methods for CVE-2026-75308

Indicators of Compromise

POST requests to /api/upload with filenames ending in .html, .htm, .jsp, .jspx, or double extensions such as .jpg.jsp.
Newly created files in yshopmall upload directories with executable or markup extensions.
Outbound requests from the application host to attacker-controlled infrastructure following an upload event.
Web server access logs showing direct GET requests to uploaded .jsp files under upload paths.

Detection Strategies

Inspect web server and reverse proxy logs for POST traffic to /api/upload where the Content-Disposition filename contains non-image extensions.
Deploy file integrity monitoring on yshopmall upload directories to alert on creation of script or markup files.
Correlate upload events with subsequent GET requests that return text/html or trigger JSP compilation.

Monitoring Recommendations

Forward web application logs to a centralized analytics platform and alert on anomalous upload extensions.
Enable JSP compilation audit logging in the servlet container to detect unexpected compilation events.
Baseline typical upload volumes and file types; alert on deviations that suggest scripted abuse.

How to Mitigate CVE-2026-75308

Immediate Actions Required

Restrict access to /api/upload at the reverse proxy or WAF until a validated patch is applied.
Enforce an allow-list of file extensions and MIME types at the perimeter, blocking .html, .htm, .jsp, .jspx, .war, and similar executable types.
Audit yshopmall upload directories for existing malicious files and remove any unauthorized artifacts.
Rotate credentials and session tokens if XSS exposure is suspected.

Patch Information

No vendor patch is referenced in the CVE record at publication time. Monitor the GitHub Issue Discussion and the yshopmall project for a fixed release. Apply the update as soon as it becomes available.

Workarounds

Serve the upload directory from a location where the servlet container does not compile or execute JSP files.
Configure the web server to return uploaded content with Content-Disposition: attachment and a restrictive Content-Security-Policy to neutralize inline scripts.
Rename uploaded files to server-generated identifiers and strip original extensions before storage.
Require authentication and per-user rate limits on the upload endpoint.

bash

# Example Nginx configuration to block executable uploads and force download
location /api/upload {
    client_max_body_size 5m;
    if ($request_method = POST) {
        if ($http_content_disposition ~* "\.(jsp|jspx|html?|war|phtml)") {
            return 403;
        }
    }
    proxy_pass http://yshopmall_backend;
}

location /uploads/ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'";
    types { } default_type application/octet-stream;
}