CVE-2026-94045 | newbee-ltd newbee-mall up to 1.0.0 Goods Save Endpoint UploadController.java goodsName cross site scripting (Issue 126)

A vulnerability classified as problematic has been found in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting.

This vulnerability was named CVE-2026-94045. The attack may be initiated remotely. In addition, an exploit is available.

ImageIO.read() is a format-agnostic read – it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the “image-only” guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More