CVE-2026-94045: newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/ static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access and user interaction are required for exploitation?
The CVSS vector indicates low privileges are required and user interaction is required. The attack can be initiated remotely by manipulating the goodsName argument.
Why can an image-only upload check be bypassed?
ImageIO.read() can return a non-null result for a polyglot PNG payload containing an HTML image element with an onerror handler. The attacker-controlled suffix and the /upload/** static mapping then make the uploaded content usable for persisted XSS.
Is a fix or workaround available?
The affected project was notified through an issue report but had not responded at the time of publication. No vendor fix or workaround is provided in the available information; public exploit code has been released.