CVE-2026-94045: newbee-mall XSS Vulnerability

CVE-2026-94045 Overview

CVE-2026-94045 is a stored cross-site scripting (XSS) vulnerability affecting newbee-ltd newbee-mall through version 1.0.0. The flaw resides in the Goods Save Endpoint implemented in controller/common/UploadController.java. Attackers manipulate the goodsName argument to inject persistent script payloads that execute in the browsers of subsequent viewers. The issue is remotely exploitable and a public exploit has been released. The maintainers were notified through an issue report but have not responded.

Critical Impact
A polyglot PNG containing an <img onerror> payload bypasses the image-only upload guard because ImageIO.read() performs a format-agnostic read, and the /upload/** static mapping serves the attacker-controlled file, converting the upload into persisted XSS.

Affected Products

newbee-ltd newbee-mall versions up to and including 1.0.0
Goods Save Endpoint (controller/common/UploadController.java)
Deployments exposing the /upload/** static resource mapping

Discovery Timeline

2026-09-20 - CVE-2026-94045 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94045

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The Goods Save Endpoint accepts a goodsName parameter and an uploaded file without sufficient sanitization. The application persists both, then serves the file through a static mapping and renders the goods name in downstream views. When a victim loads a page that references the malicious file or the tainted goods name, the injected script executes in the victim's session context.

Exploitation requires low-privilege authenticated access and some user interaction to trigger the stored payload. The public exploit release increases the likelihood of opportunistic abuse against exposed instances.

Root Cause

The upload handler relies on ImageIO.read() to validate that an uploaded artifact is an image. This check is format-agnostic and returns a non-null value for polyglot files that are simultaneously valid PNGs and valid HTML fragments carrying an <img onerror> payload. The guard therefore accepts crafted files that browsers later interpret as HTML. Combined with an attacker-controlled filename suffix and no output encoding on goodsName, the endpoint stores executable content instead of a benign image.

Attack Vector

An authenticated attacker submits a POST request to the Goods Save Endpoint with a polyglot file and a goodsName value containing script markup. The Spring /upload/** static resource mapping exposes the stored file directly, and the tainted goods name is rendered in product listings and detail pages. Any authenticated user, including administrators, who views the affected content triggers the payload, enabling session token theft, forced actions in the application context, or delivery of secondary payloads.

See the VulDB entry for CVE-2026-94045 and the upstream newbee-mall repository for additional technical context.

Detection Methods for CVE-2026-94045

Indicators of Compromise

Files stored under the /upload/ directory with dual-extension or unusual suffixes such as .png.html or content-type mismatches between magic bytes and file extension.
Product records where the goodsName field contains HTML tags, <script>, or event handlers such as onerror, onload, or onclick.
HTTP requests to the Goods Save Endpoint immediately followed by GETs to the same /upload/** path from different session identifiers.

Detection Strategies

Inspect stored upload artifacts for polyglot signatures by comparing the leading magic bytes against the served MIME type and file extension.
Add web application firewall rules that block form fields containing balanced HTML tag patterns in goodsName on POST requests to the Goods Save Endpoint.
Correlate authenticated upload events with anomalous outbound requests from browsers of privileged users, which may indicate payload execution.

Monitoring Recommendations

Log every write to the upload directory with the submitting account, source IP, original filename, and stored filename for retroactive hunting.
Alert on newly created files served under /upload/** whose response content type is text/html or application/xhtml+xml.
Track administrator sessions for unexpected state-changing requests generated shortly after viewing goods pages.

How to Mitigate CVE-2026-94045

Immediate Actions Required

Restrict access to the Goods Save Endpoint to trusted administrative users and place the application behind authenticated network controls until a fix is available.
Purge existing upload artifacts and product records whose goodsName field contains HTML markup or event handler attributes.
Reconfigure the static resource mapping to serve upload files with Content-Disposition: attachment and a fixed Content-Type derived from server-side inspection rather than the client-supplied extension.

Patch Information

As of the last NVD update on 2026-09-24, the project maintainers have not published a patch or advisory. The reporter opened GitHub Issue #126 without response. Operators should track the newbee-mall repository for future fixes and consider forking to apply local remediations.

Workarounds

Replace the ImageIO.read() check with a strict allow-list validator that verifies magic bytes, re-encodes the image server-side, and rewrites the filename to a server-generated UUID with a canonical extension.
Apply contextual output encoding on goodsName in every view template and reject input containing angle brackets or event handler tokens at the controller boundary.
Deploy a Content Security Policy that disallows inline scripts and restricts image sources to the application origin, reducing the impact of any residual injection.

bash

# Configuration example: restrictive CSP header for the newbee-mall front end
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";
add_header X-Content-Type-Options "nosniff";