The flaw resides in the /api/upload endpoint, which accepts files without validating type or content. Attackers can upload malicious payloads such as HTML or JSP files that, when executed by a victim’s browser, can perform JavaScript injection or arbitrary code execution. This enables tampering with the site’s appearance, stealing session cookies, or injecting further attacks. The vulnerability is a classic Cross‑Site Scripting weakness (CWE‑79).

yshopmall version 3.3 and all earlier releases are affected. Users who rely on the file upload feature are exposed to the risk that any file they submit could be a vector for XSS or executable code.

The CVSS score is not publicly disclosed, and the EPSS score is unavailable, so the exact risk magnitude is unknown. The vulnerability is listed as not part of the CISA KEV catalog. Exploitation requires a user to upload a craftily malicious file and subsequently access or view it; no elevated privileges are required. Once an attacker’s payload is delivered, the impact is limited to the browsers of users who view the uploaded content, but it can have broader implications if session hijacking or defacement occur.