tamguo version 1.5.3 is vulnerable because its FileUploadController and UEditorController endpoints lack file type validation, enabling attackers to upload arbitrary HTML or JavaScript files. The result is a stored cross‑site scripting vulnerability, whereby malicious scripts are later executed in the browsers of any user who accesses the uploaded content, potentially exposing credentials, session tokens, or other sensitive data.

Only tamguo 1.5.3 is directly affected by this flaw. External libraries or other components that rely on tamguo's file upload functionality are also compromised if they do not implement protective measures. The vulnerability is confined to the web application’s upload endpoints /uploadFile and /imgUpload, and it does not affect other tamguo versions or products that have applied protective measures.

Because the flaw permits upload of arbitrary files without authentication restrictions or MIME type checks, attackers can exploit it remotely on publicly accessible installations, provided the vulnerable endpoints are reachable. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The CVSS score of 4.6 classifies it as low severity, but the lack of file type validation can still lead to persistent script execution that compromises the confidentiality and integrity of users who view the injected content.