Description

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-26T22:16:29.210Z",
  "pubdate": "2026-08-26T22:16:29.210Z",
  "executiveSummary": "The tamguo 1.5.3 application contains a critical security flaw involving unrestricted file upload functionality, which facilitates Stored Cross-Site Scripting (XSS) attacks. This vulnerability stems from the absence of server-side file type validation within the application's image and file handling controllers.\nBy bypassing client-side restrictions, an unauthenticated or authenticated attacker can upload malicious payloads, specifically HTML or JavaScript files, directly to the server's directory structure. Once uploaded, these files can be accessed via a direct URL, enabling the execution of arbitrary JavaScript within the context of the victim's browser session.\nThe impact of this vulnerability is significant, as it allows for session hijacking, cookie theft, sensitive data exfiltration, and unauthorized actions performed on behalf of legitimate users. Furthermore, since the application does not enforce mime-type or extension filtering, attackers have broad capabilities to deploy various web-based malicious scripts. The risk to the integrity and confidentiality of the application is high, necessitating immediate remediation to prevent persistent client-side code execution.",
  "technicalDetails": "The vulnerability is localized within the FileUploadController.java and UEditorController.java components of tamguo 1.5.3. The root cause is a lack of rigorous input sanitization and server-side validation mechanisms for the /uploadFile and /imgUpload endpoints. The application fails to inspect the Content-Type header or the file extension of incoming multipart/form-data requests, allowing for the transmission of arbitrary file types.\nThe exploitation flow begins with the attacker identifying the /uploadFile or /imgUpload endpoints. The attacker prepares a payload—typically an HTML file containing malicious `<script>` tags or an obfuscated JavaScript file. Because there is no server-side validation, the application accepts the request and proceeds to write the malicious file to the server's public-facing storage directory. Upon successful upload, the server typically returns a path or URL pointing to the newly stored file.\nOnce the file is hosted, the attacker can trigger the stored XSS by providing the direct link to the uploaded file to other users or administrators. When a target user navigates to the URL, the browser renders the content as HTML, executing the embedded malicious script within the origin of the vulnerable domain. This bypasses the Same-Origin Policy (SOP) constraints, as the browser treats the malicious file as a legitimate component of the application.\nPost-exploitation, the attacker can leverage the XSS payload to perform a wide range of malicious actions. This includes, but is not limited to, harvesting session cookies (if the HttpOnly flag is missing or incorrectly configured), modifying the Document Object Model (DOM) to present phishing interfaces, or redirecting users to malicious external sites. Because the files are stored persistently on the server, the attack vector remains active until the files are manually removed or the upload functionality is properly patched. The vulnerability does not require complex infrastructure, as the primary requirement is the ability to send standard HTTP POST requests to the identified controllers."
}