Login Request a demo
High severity · published Feb 8, 2026
CVE-2026-2146
guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YS
yshopmall · guchengwuyue
1.9.0; 1.9.1 · source: vendor, NVD
Affected product
YS
yshopmall
guchengwuyue
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2146
Product
https://github.com/guchengwuyue/yshopmall/
Exploit
https://github.com/guchengwuyue/yshopmall/issues/40
Exploit
https://github.com/guchengwuyue/yshopmall/issues/40#issue-3860542812
Permissions Required
https://vuldb.com/?ctiid.344848
Third Party Advisory
https://vuldb.com/?id.344848
Third Party Advisory
https://vuldb.com/?submit.747409
More from yshopmall
9.8
CVE-2025-15496
guchengwuyue yshopmall jobs getPage sql injection
9.8
CVE-2024-50648
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files
7.2
CVE-2025-25426
yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface
7.1
CVE-2026-110119
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
5.4
CVE-2026-110120
yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController