CVE-2026-86668: Cross Site Scripting in aircheng-org iWebShop-5

This vulnerability in aircheng-org iWebShop-5 up to version 5.15 allows an attacker to perform cross-site scripting via the uploadFile function in controllers/pic.php by manipulating the outerSrc/selectPhoto parameter. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. The vulnerability does not involve confidentiality, integrity, or availability impacts but can lead to limited integrity impact through script injection. The vulnerability has been publicly disclosed, and no official patch or vendor response has been noted.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to user session hijacking, defacement, or other malicious actions limited to the scope of the XSS. There is no direct impact on confidentiality, availability, or system-level integrity. The attack requires user interaction and is of medium severity.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, consider applying web application firewall (WAF) rules to detect and block malicious payloads targeting the vulnerable parameter. Avoid exposing the vulnerable functionality to untrusted users where possible.