CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users with publisher privileges to upload files to arbitrary server-accessible locations without proper validation of file types or destinations. This could lead to remote code execution if the uploaded files are executed by the server, posing a critical risk to the integrity and security of the system. Organizations using this API, particularly those with administrative access controls, should prioritize remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.