This vulnerability in newbee-mall up to version 1.0.0 allows remote attackers to perform cross-site scripting via the goodsName parameter in the Goods Save Endpoint. The attack bypasses image upload restrictions by exploiting ImageIO.read()'s format-agnostic behavior, which accepts polyglot payloads such as PNG combined with <img onerror> tags. The static mapping of the upload path converts this into a persistent XSS vulnerability. The project was notified but has not issued a fix or response.

Successful exploitation allows an attacker to inject and execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions performed by the victim's browser. The vulnerability is remotely exploitable and can persist due to the upload mechanism, increasing the risk of ongoing exploitation.

No official fix or patch has been released by the vendor as of the current information. Users should monitor the vendor's advisories for updates. Until a fix is available, consider restricting or disabling the vulnerable upload functionality or implementing additional input validation and sanitization on the goodsName parameter to mitigate exploitation.