CVE-2025-3558 is a medium severity flaw (CVSS 6.3) in ghostxbh uzy-ssm-mall 1.0.0. The user head image upload endpoint accepts files without proper restriction, so an attacker can upload unwanted file types. The record says the vendor did not respond, and no fixed version is listed.
What's affected
The record says uzy-ssm-mall version 1.0.0 is affected. The weak spot is the path /mall/user/uploadUserHeadImage and its File argument. The record states the attack can be started remotely and that the exploit has been disclosed to the public.
It also says the vendor was contacted early and did not respond in any way. There is no fixed version in the record, so assume none exists unless the project says otherwise. The references are VulDB entries and a write up from the reporter. The record lists two weaknesses, CWE-284 for improper access control and CWE-434 for unrestricted upload.
How to check if you're exposed
- Confirm whether your deployment is uzy-ssm-mall 1.0.0 by checking the project files or build.
- Check whether the upload path is reachable from the internet.
- Inspect the upload directory for files with extensions that do not match images, such as script or archive types.
- Review access logs for repeated posts to the upload path.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- If the application is not needed, take it offline.
- Place the upload path behind authentication and rate limits at the reverse proxy.
- Configure the web server so the upload directory cannot run scripts, and serve uploads with a fixed image content type.
- If you can change the code, accept only a short allowlist of image types and check the content, not just the file name.
- Store uploads outside the web root and rename them on save.
- Plan a move to a maintained alternative, since the vendor is unresponsive.
Why it matters
Upload features are a common source of serious bugs. The record names CWE-434, where the application does not stop dangerous file types, and CWE-284, where access to the feature is not controlled properly.
What an attacker gains depends on how the server treats the file after upload. If it is only stored as an image, the harm is small. If it can be run or served as active content, the impact grows. The score is medium partly because a logged in user context is likely needed. This CVE is not on the CISA Known Exploited Vulnerabilities list. Public exploit details do lower the bar for abuse.
A vendor that does not reply is itself a risk signal. Add that to your dependency review criteria.
Quick check
Is there a fixed version?
The record lists none and says the vendor did not respond. Use compensating controls or retire the application.
What is the quickest mitigation?
Take the app offline if it is not needed. If it is, protect the upload path and block script execution in the upload directory.
Sources
Last reviewed: 18 October 2026.
