easyii CMS File Upload Management Upload.php file unrestricted upload

The vulnerability affects the file upload functionality in easyii CMS, specifically in the file function of helpers/Upload.php. The component fails to properly validate file types, leading to an unrestricted upload condition [1].

An attacker can exploit this flaw remotely by sending a crafted HTTP request to the file upload endpoint, without requiring authentication. The only prerequisite is network access to the vulnerable CMS instance.

Successful exploitation allows the attacker to upload arbitrary files, including executable scripts (e.g., PHP shells). This could lead to remote code execution, full site compromise, or data exfiltration.

As of the publication date, no official patch has been released. Administrators should restrict upload capabilities and review file permissions to mitigate the risk.