CVE-2026-75331: tamguo File Upload XSS Vulnerability

CVE-2026-75331 Overview

CVE-2026-75331 is an unrestricted file upload vulnerability in tamguo version 1.5.3 that leads to stored cross-site scripting (XSS). The /uploadFile and /imgUpload endpoints, implemented in FileUploadController.java and UEditorController.java, fail to validate uploaded file types. Attackers can upload arbitrary HTML and JavaScript files to the server, which are then served to other users and executed in their browsers. This combination of missing file-type enforcement and direct content serving turns the upload feature into a persistent XSS delivery mechanism.

Critical Impact
Unauthenticated or low-privilege attackers can upload malicious HTML or JavaScript files that execute in victim browsers, enabling session theft, credential harvesting, and account takeover.

Affected Products

tamguo 1.5.3
FileUploadController.java component (/uploadFile endpoint)
UEditorController.java component (/imgUpload endpoint)

Discovery Timeline

2026-08-26 - CVE-2026-75331 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75331

Vulnerability Analysis

The vulnerability resides in two upload handlers within the tamguo application. FileUploadController.java exposes the /uploadFile endpoint, and UEditorController.java exposes the /imgUpload endpoint. Neither handler enforces MIME type checks, file extension allowlists, or content inspection before writing files to disk.

An attacker submits a crafted file with an HTML or JavaScript extension containing embedded scripts. The server accepts the upload and stores it in a location reachable through a predictable URL. When a victim requests the file, the browser interprets the payload as active content and executes the attacker-supplied script under the application's origin.

Because the payload is persisted server-side, every subsequent visitor to the file URL triggers the script. Attackers can chain this behavior with social engineering or direct linking to steal session cookies, perform actions on behalf of the victim, or deface application pages.

Root Cause

The root cause is missing input validation on file uploads. The controllers accept arbitrary Content-Type values and extensions without enforcing an allowlist of safe formats such as image/png or image/jpeg. No server-side re-encoding or content sniffing prevents HTML and JavaScript payloads from reaching the storage directory.

Attack Vector

The attack requires HTTP access to the vulnerable endpoints. An attacker sends a multipart form request to /uploadFile or /imgUpload containing a file such as payload.html with <script> tags. After a successful upload, the attacker distributes the resulting URL to victims. The uploaded file is served with a rendering-capable content type, causing the browser to execute the embedded script within the tamguo application origin.

Further technical details are available in the GitHub XSS Vulnerability Report.

Detection Methods for CVE-2026-75331

Indicators of Compromise

HTTP POST requests to /uploadFile or /imgUpload containing files with .html, .htm, .js, .svg, or .xhtml extensions.
Files stored in the tamguo upload directory whose content contains <script>, onerror=, or javascript: strings.
Outbound requests from user browsers to attacker-controlled domains shortly after loading a tamguo-hosted uploaded file.
Access log entries showing repeated GET requests to newly uploaded files from multiple client IPs.

Detection Strategies

Inspect web server access logs for uploads whose response content type is text/html or application/javascript when served back to clients.
Scan the upload storage directory for files containing HTML or script markers that should not exist in an image repository.
Deploy web application firewall rules that flag multipart uploads to /uploadFile and /imgUpload with non-image extensions or magic bytes.

Monitoring Recommendations

Alert on any successful upload response for file extensions outside a defined image allowlist.
Monitor for anomalous spikes in requests to the uploads directory, which may indicate payload distribution.
Correlate authentication events with subsequent script-loaded pages to identify session hijacking attempts.

How to Mitigate CVE-2026-75331

Immediate Actions Required

Restrict access to the /uploadFile and /imgUpload endpoints at the reverse proxy or WAF until a patched version is deployed.
Remove any untrusted files already present in the tamguo upload directory and audit for signs of exploitation.
Rotate session tokens and application secrets if evidence suggests uploaded content was accessed by users.

Patch Information

No vendor patch is referenced in the published advisory. Monitor the tamguo project for a fixed release addressing FileUploadController.java and UEditorController.java. Track updates through the GitHub XSS Vulnerability Report.

Workarounds

Enforce a server-side allowlist of file extensions and MIME types, rejecting anything outside approved image formats such as png, jpg, jpeg, gif, and webp.
Validate file content using magic-byte inspection rather than relying on client-supplied metadata.
Serve uploaded files from a separate origin with Content-Disposition: attachment and X-Content-Type-Options: nosniff headers to prevent inline script execution.
Rename uploaded files to random identifiers without preserving user-supplied extensions.

bash

# Example nginx configuration hardening for the uploads directory
location /uploads/ {
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    add_header Content-Disposition "attachment" always;
    types { image/png png; image/jpeg jpg jpeg; image/gif gif; image/webp webp; }
    default_type application/octet-stream;
}