CVE-2025-0399: StarSea99 starsea-mall uploadController.java UploadController unrestricted upload

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-12 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

StarSea99 starsea-mall: 1.0.0

References

https://github.com/StarSea99/starsea-mall/issues/3
https://github.com/StarSea99/starsea-mall/issues/3#issue-2765550309
https://vuldb.com/?ctiid.291274
https://vuldb.com/?id.291274
https://vuldb.com/?submit.473319

Get alerted when CVE-2025-0399 or the next vulnerability affects your stack