Executive brief
tamguo is an online education platform built on Spring Boot. The application has two file upload endpoints (/uploadFile and /imgUpload) that accept arbitrary file types with no validation. Attackers can upload HTML or JavaScript files that are then served as static resources to other users, enabling stored XSS attacks, phishing page injection, and session hijacking.
Technical details
The vulnerability is an unrestricted file upload flaw in FileUploadController.java and UEditorController.java. The /uploadFile and /imgUpload endpoints extract only the file extension from the original filename without validating file type or content. Combined with Apache Shiro security configuration that maps /** to anonymous access, attackers can upload malicious HTML/JavaScript files without authentication. These files are served as static resources on the same origin, enabling stored XSS, phishing, and CSRF token theft. Affected versions include 1.0.3 and 1.5.3.
Affected products
- tamguo tamguo 1.0.3, 1.5.3
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-75331