CVE-2026-75331: XSS
Published Aug 26, 2026
·Updated
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server.
Affected Software
1 affected component
tamguo=1.5.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.3 - Configuration
Add server-side file type validation for uploads handled by /uploadFile in FileUploadController.java to prevent uploading arbitrary HTML/JavaScript.
FileUploadController.java (/uploadFile) file type validation = enforce allowed file types - Configuration
Add server-side file type validation for uploads handled by /imgUpload in UEditorController.java to prevent uploading arbitrary HTML/JavaScript.
UEditorController.java (/imgUpload) file type validation = enforce allowed file types
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:16 PM
Description