CVE-2026-100880: zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting
A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
zhistaredu StarTraining versions up to 3.8.1 are identified as affected. The issue is associated with the Upload Endpoint and code in du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java.
What access does an attacker need to exploit this?
The attack can be initiated remotely, but the supplied severity vector indicates the attacker needs low-level privileges and user interaction. Exploitation involves manipulating the File argument to trigger cross-site scripting.
Is public exploit code available?
Yes. The vulnerability data states that an exploit has been made public and could be used in attacks.
Is a vendor fix available?
No vendor response or fix information is provided. The vendor was contacted early regarding the disclosure but did not respond.