CVE-2026-88392

Summary

Unimall v4 allows attackers to perform directory traversal during file uploads, enabling them to write arbitrary files to the server's filesystem and potentially execute code. This vulnerability exists in the FileUploadController.local() method and can be exploited without authentication.

Exploitability

The exploit is straightforward to execute with no authentication required, as attackers can simply craft a malicious upload request that includes directory traversal sequences to write files outside the intended upload directory.

Blast radius

If exploited, this vulnerability could allow attackers to upload malicious files such as web shells or configuration files that could lead to full system compromise and persistent access to the affected server.

Detection

Monitor for unusual file creation patterns in the web application's upload directory, particularly files with executable extensions (e.g., .php, .jsp) that appear without user interaction, and watch for HTTP requests containing directory traversal sequences like '../' in the filename parameter of POST requests to the file upload endpoint.

Prioritized remediation

Upgrade to Unimall v4.1 or later, which contains the patched FileUploadController.local() method that properly sanitizes file paths during uploads.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.