CVE-2025-15448 is a medium severity unrestricted file upload (CVSS 6.3) in JavaMall, through the Upload function of MinioController.java, up to commit 994f1e2b. The project uses rolling releases, the vendor did not respond, and no fix is confirmed. Restrict who can upload and inspect stored files.
What's affected
The record names cld378632668 JavaMall up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 as affected. The weak function is Upload in src/main/java/com/macro/mall/controller/MinioController.java. The record says the manipulation results in unrestricted upload and that the attack can be launched remotely.
The project ships rolling releases, so the record says version details for affected and updated releases are not available. The vendor did not respond, so I cannot name a fix. A sibling report, CVE-2025-15449, covers the delete function in the same controller.
The attack needs a low privilege account (PR:L in the vector), so a login is required before the upload path is reachable.
How to check if you're exposed
Because JavaMall tracks a branch rather than numbered releases, compare commits.
git log --oneline | grep 994f1e2
git merge-base --is-ancestor 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 HEAD && echo "includes the affected commit"
If your deployed commit is at or before that hash, treat it as affected. Then look at the storage side. The controller sends files to MinIO object storage, so list the bucket for files with executable or script extensions that nobody expected, and review recent uploads by account.
What to do now
- Identify which JavaMall commit you deploy and whether it is at or before the commit in the record.
- Restrict the upload endpoint to the accounts and file types you actually need, and enforce the allowlist on the server, not in the browser.
- Store uploads in a bucket that never serves content as executable and never sits in a web root.
- Review the MinIO bucket for files you do not recognize and remove them.
- Watch the upstream project for a fix, and consider moving off an unmaintained base if none arrives.
Why it matters
The record carries CWE-434, Unrestricted Upload of File with Dangerous Type, and CWE-284, Improper Access Control. The server accepts a file without confirming that its type and name are safe, and without enough checks on who is uploading and where it goes. What an upload can do depends on how the files are served afterward: stored in a locked bucket they do little, served from a web path they can become a foothold.
The score is medium because the attacker needs an account and the effect is limited by storage design. It is not in CISA's Known Exploited Vulnerabilities catalog per the record. The record says the exploit was disclosed publicly.
Quick check
Do I need an account to abuse this?
The CVSS vector lists low privileges required, so a login is part of the described attack.
Is a numbered fix available?
No. The project uses rolling releases and the record says affected and fixed versions are not available.
Sources
Last reviewed: 19 October 2026.
