CVE-2026-86668: iWebShop-5 Cross Site Scripting Vulnerability

CVE-2026-86668 Overview

CVE-2026-86668 is a cross-site scripting (XSS) vulnerability affecting aircheng-org iWebShop-5 versions up to and including 5.15. The flaw resides in the uploadFile function within controllers/pic.php. Attackers can manipulate the outerSrc and selectPhoto arguments to inject arbitrary script content. The issue is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, but the attack can be performed remotely over the network. Public exploit details have been disclosed, and the project maintainers had not responded to the disclosure at the time of publication.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session by supplying crafted values to the outerSrc or selectPhoto parameters of the uploadFile endpoint.

Affected Products

aircheng-org iWebShop-5 up to version 5.15
Affected component: controllers/pic.php
Affected function: uploadFile

Discovery Timeline

2026-09-08 - CVE-2026-86668 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86668

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting flaw within the uploadFile handler of the iWebShop-5 image controller. The outerSrc and selectPhoto parameters are incorporated into rendered output without adequate encoding or sanitization. An attacker can craft a URL or request that, when processed, causes browser-executed script to run in the context of the iWebShop application.

Because the flaw affects an image upload workflow, injected payloads can persist through file metadata or reflected response paths. The impact is limited to integrity of the browser session, with no direct effect on server confidentiality or availability. Successful exploitation can lead to session token theft, forced administrative actions, or phishing overlays served from the trusted store domain.

Root Cause

The root cause is missing output encoding and input validation on the outerSrc and selectPhoto arguments processed by uploadFile in controllers/pic.php. The application accepts user-controlled string values and reflects them into HTML or JavaScript contexts without applying context-aware escaping. This aligns with [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker crafts a request to the uploadFile endpoint containing a malicious payload in the outerSrc or selectPhoto parameter. Delivery typically occurs through a phishing link or a maliciously embedded resource that the victim loads while authenticated to the iWebShop instance. When the response renders, the injected script executes in the victim's browser under the origin of the vulnerable application. No authentication is required to trigger the injection, but user interaction is needed to load the crafted request. Detailed technical write-ups are available at the VulDB CVE-2026-86668 Details entry and the GitHub iWebShop-5 Issue Tracker.

No verified proof-of-concept code has been published in a form that can be cited directly. Refer to the linked references for reproduction details.

Detection Methods for CVE-2026-86668

Indicators of Compromise

Requests to controllers/pic.php or the uploadFile endpoint containing HTML tags, JavaScript event handlers, or URL-encoded script fragments in the outerSrc or selectPhoto parameters.
Unexpected outbound requests from user browsers to attacker-controlled domains following interaction with iWebShop pages.
Anomalous session activity for authenticated administrators shortly after visiting externally referred iWebShop links.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the outerSrc and selectPhoto parameters for common XSS payload signatures such as <script, onerror=, javascript:, and encoded variants.
Enable HTTP response inspection to identify reflected parameter values within HTML or JavaScript contexts of iWebShop responses.
Correlate access logs with referer headers to identify externally initiated requests targeting the uploadFile endpoint.

Monitoring Recommendations

Monitor controllers/pic.php access patterns for spikes in unique parameter values or unusually long parameter payloads.
Track Content Security Policy (CSP) violation reports for inline script or external resource loads that fall outside expected origins.
Alert on authenticated administrator sessions performing high-privilege actions immediately following a page load that referenced outerSrc or selectPhoto.

How to Mitigate CVE-2026-86668

Immediate Actions Required

Restrict access to the iWebShop administrative interface using IP allow-listing or a reverse proxy authentication layer until a vendor patch is available.
Deploy a WAF rule set that blocks requests containing script tags or JavaScript event handlers in the outerSrc and selectPhoto parameters.
Enforce a strict Content Security Policy on the iWebShop application to limit script execution to trusted sources.

Patch Information

No vendor patch is available at the time of publication. The project was informed through a public GitHub iWebShop-5 Issue Tracker report but has not responded. Track the GitHub iWebShop-5 Repository for future releases addressing this issue.

Workarounds

Apply server-side input validation at a reverse proxy layer to reject non-URL values submitted in outerSrc and selectPhoto parameters.
Configure output encoding at the template layer for any field that reflects outerSrc or selectPhoto values, applying HTML entity encoding for HTML contexts and JavaScript string escaping for script contexts.
Consider migrating to an actively maintained e-commerce platform if the vendor remains unresponsive.

bash

# Example WAF rule (ModSecurity) blocking script payloads in vulnerable parameters
SecRule ARGS:outerSrc|ARGS:selectPhoto "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026866680,phase:2,deny,status:403,log,msg:'CVE-2026-86668 iWebShop-5 XSS attempt blocked'"