Executive brief
SmartAdmin is a rapid development platform used to build business applications. The file upload feature fails to properly validate and sanitize user-uploaded files, allowing authenticated users to upload HTML files containing malicious scripts. When other users access or view these files, the scripts execute in their browsers, potentially compromising their accounts or stealing sensitive data.
Technical details
This vulnerability is a stored cross-site scripting (XSS) flaw in the FileController.java upload() endpoint. An authenticated user can upload an HTML file (despite claiming to be an image via Content-Type header) containing embedded JavaScript. When the uploaded file is served from the application's origin, the browser executes the script in the security context of any user who opens it. The root cause is insufficient server-side validation of file content and type. An attacker needs valid authentication and file upload privileges, but no interaction from other users beyond viewing the file is required. Remediation involves validating file extensions and MIME types server-side, rejecting active HTML content, using server-generated file names, serving untrusted files from an isolated origin or as downloads with proper headers, and applying X-Content-Type-Options: nosniff.
Affected products
- 1024-lab SmartAdmin 3.30.0
Timeline
- 2026-09-15: disclosed