tamguo version 1.5.3 is vulnerable because its FileUploadController and UEditorController endpoints lack file type validation, enabling attackers to upload arbitrary HTML or JavaScript files. The result is a stored cross‑site scripting vulnerability, whereby malicious scripts are later executed in the browsers of any user who accesses the uploaded content, potentially exposing credentials, session tokens, or other sensitive data.

Only tamguo 1.5.3 is directly affected by this flaw. External libraries or other components that rely on tamguo's file upload functionality are also compromised if they do not implement protective measures. The vulnerability is confined to the web application’s upload endpoints /uploadFile and /imgUpload, and it does not affect other tamguo versions or products that have applied protective measures.

Because the flaw permits upload of arbitrary files without authentication restrictions or MIME type checks, attackers can exploit it remotely on publicly accessible installations, provided the vulnerable endpoints are reachable. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that no public exploit or widespread exploitation has been reported yet. However, the absence of a filter and the potential for persistent script execution make the risk for confidentiality and integrity high for any user who views the injected content. No CVSS score is supplied, so severity cannot be quantified from the CVE record alone.