CVE-2025-15448
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability was found in the JavaMall project (cld378632668) in the Upload function of MinioController.java. Input manipulation leads to unrestricted file upload, and the attack can be launched remotely. The product uses rolling releases, so version details are unavailable, and the vendor did not respond to the disclosure.
Risk Assessment
Unrestricted file upload may allow an attacker to place malicious code on the server, leading to remote code execution and full system compromise. The risk is high because the attack is remote and may not require authentication.
Recommendation
Immediately review and restrict the Upload function in MinioController.java by enforcing file type and size validation and authentication. If possible, update to the latest version or apply a workaround until a patch is released.
Other vulnerabilities in JavaMall
Original NVD description (English source)
A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/com/macro/mall/controller/MinioController.java. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS