CVE-2026-75308: XSS

Q: Which deployments are affected?

The affected software is yshopmall version 3.3 and earlier. The issue is in the /api/upload file upload endpoint.

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to submit files to the /api/upload endpoint. Because the endpoint lacks file-type validation, they can upload arbitrary file types, including HTML and JSP files.

Q: What should be restricted if an update cannot be applied immediately?

Restrict access to /api/upload to trusted users or networks and prevent uploaded files from being served or executed. The reported issue stems from accepting arbitrary file types at that endpoint.

Published Sep 9, 2026

Updated

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.

Affected Software

1 affected component

yshopmall<=3.3

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are affected?

The affected software is yshopmall version 3.3 and earlier. The issue is in the /api/upload file upload endpoint.

What does an attacker need to exploit this issue?

An attacker needs to be able to submit files to the /api/upload endpoint. Because the endpoint lacks file-type validation, they can upload arbitrary file types, including HTML and JSP files.

What should be restricted if an update cannot be applied immediately?

Restrict access to /api/upload to trusted users or networks and prevent uploaded files from being served or executed. The reported issue stems from accepting arbitrary file types at that endpoint.