A stored XSS vulnerability exists in the file template editing of ujcms_v9.7.5.

[IceFoxH]

【Vulnerability Description】
There is a vulnerability in the template file editing function of the ujcms_v9.7.5 backend. The embedded JavaScript is not filtered or checked. When users access files with embedded malicious code, the malicious JavaScript code will be triggered, which may lead to the theft of sensitive tokens.

【Vulnerability Type】
CWE-79: Cross-site Scripting

【Product Vendor】
https://gitee.com/ujcms/ujcms
https://github.com/ujcms/ujcms
https://www.ujcms.com/

【Affected Product Code Repository】
ujcms_v9.7.5

【Vulnerability Proof】
Edit template file

【Code Location】
/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java#update

【Code Analysis】
The updated file content is saved without verification

【Repair Suggestions】
Perform security checks on the updated file content