Description
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-20
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting
Action: Assess
AI Analysis

Impact

The vulnerability resides in the goods creation endpoint of Newbee‑Mall, where malicious content can be injected via the goodsName parameter. This allows an attacker to embed arbitrary script fragments that are executed when the page is viewed, resulting in client‑side code injection. The flaw is classified as CWE‑79 (Cross‑Site Scripting) and CWE‑94 (Improper Handling of Class/File Names), highlighting that untrusted input is not safely encoded or validated before being rendered.

Affected Systems

Newbee‑Ltd’s Newbee‑Mall product up to version 1.0.0 has been identified as vulnerable. The specific code path involves the UploadController.java component within the goods save endpoint, and the bug can be triggered by supplying a crafted goodsName argument.

Risk and Exploitability

With a CVSS score of 5.1, the vulnerability carries a moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, but the public exploit remains available and can be activated remotely via HTTP requests. Attackers can exploit the flaw by sending a specially crafted goodsName payload that is processed by ImageIO.read(), bypassing the image‑only guard and causing the payload to be persisted and executed in the user interface.

Generated by OpenCVE AI on September 20, 2026 at 19:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or newer release of Newbee‑Mall as soon as it is available.
  • Implement strict input validation or proper HTML encoding on the goodsName field to neutralize injected scripts.
  • Enforce a whitelist for acceptable image file types, avoiding format‑agnostic reads that allow polyglot PNG payloads.
  • Disable or secure the /upload/ static mapping that permits persisted XSS if immediate code changes are not possible.
  • Configure a Content Security Policy to mitigate the impact of any potentially injected scripts.

Generated by OpenCVE AI on September 20, 2026 at 19:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
Title newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
First Time appeared Newbee-ltd
Newbee-ltd newbee-mall
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:newbee-ltd:newbee-mall:*:*:*:*:*:*:*:*
Vendors & Products Newbee-ltd
Newbee-ltd newbee-mall
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Newbee-ltd Newbee-mall
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T18:30:10.036Z

Reserved: 2026-09-19T21:41:31.727Z

Link: CVE-2026-94045

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T19:17:13.133

Modified: 2026-09-20T19:17:13.133

Link: CVE-2026-94045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T19:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')