CVE-2026-75331: n/a

The tamguo 1.5.3 application has a vulnerability where the /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java do not validate uploaded file types. This allows an attacker with at least low privileges and requiring user interaction to upload arbitrary HTML or JavaScript files, potentially leading to stored XSS attacks. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can upload malicious HTML or JavaScript files to the server, which may be stored and later executed in the context of users accessing those files, leading to stored cross-site scripting (XSS). This can result in limited confidentiality and integrity impacts. There is no indication of availability impact or known exploits in the wild at this time.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to upload functionality to trusted users and consider implementing manual or custom file type validation as a temporary mitigation.