CVE-2026-2146: guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2146?
CVE-2026-2146 is classified as a high-severity vulnerability due to its potential for unrestricted file uploads.
How do I fix CVE-2026-2146?
To fix CVE-2026-2146, you should update guchengwuyue yshopmall to version 1.9.2 or later, which resolves the unrestricted upload issue.
What components are affected by CVE-2026-2146?
CVE-2026-2146 affects the updateAvatar function in the co.yixiang.utils.FileUtil component of guchengwuyue yshopmall versions up to 1.9.1.
What type of vulnerability is CVE-2026-2146?
CVE-2026-2146 is an unrestricted file upload vulnerability that can lead to unauthorized data access or system compromise.
Can CVE-2026-2146 be exploited remotely?
Yes, CVE-2026-2146 can be exploited remotely if an attacker can access the affected updateAvatar API.