CVE-2026-102366 describes an unrestricted file upload vulnerability in the mall4j product (versions up to 4.0). The vulnerable FileController endpoints do not enforce authorization or validate file types, permitting authenticated users to upload arbitrary files including HTML and SVG. These files can contain scripts that execute in administrator browsers when accessed locally, resulting in stored XSS. The CVSS 4.0 base score is 2.1, indicating low severity.

An attacker with any authenticated token can upload malicious files that execute scripts in administrator browsers, potentially leading to stored cross-site scripting attacks. This could allow script execution in the context of the administrator's session when the malicious files are accessed from local storage. However, the overall impact is rated low based on the CVSS score and the requirement for authenticated access.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent unauthorized file uploads and avoid accessing uploaded files from untrusted sources.