Executive brief
ZS-Admin, a Java-based administrative framework, contains a security flaw in its file management system. An authenticated user can upload files with dangerous extensions, such as .html or .svg, because the system fails to verify file types. This could allow an attacker to host malicious scripts on the server, potentially leading to the theft of user sessions or unauthorized actions through cross-site scripting (XSS).
Technical details
An unrestricted file upload vulnerability exists in ZS-Admin's `SysFileController` at the `/api/system/file/upload` endpoint. The application uses `MultipartFile.getOriginalFilename()` to extract extensions without implementing a whitelist for file types, MIME types, or magic-byte validation. An authenticated attacker can upload malicious files (e.g., .svg, .html, or .jsp) which are then stored using a UUID-based naming convention. While JSP execution was not confirmed, the ability to upload and access these files enables stored cross-site scripting (XSS) if the server renders the content inline. As of the advisory date, no patch has been released by the vendor.
Affected products
- zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead
Timeline
- 2026-06-15: disclosed: Issue reported to the project via GitHub
- 2026-07-21: advisory: NVD/VulDB advisory published