ARMBot’s upload.php contains an unrestricted file upload vulnerability. An attacker can supply a crafted file name with path traversal sequences (e.g., ../public_html/) that bypasses upload restrictions. This allows the attacker to upload arbitrary PHP files into the web root, enabling the execution of attacker‑controlled code on the server. The vulnerability directly leads to remote code execution, which compromises confidentiality, integrity, and availability of the affected instance. The weakness is identified as CWE-22, Unauthorized Write to File.

The affected product is ARMBot:ARMBot. Specific affected versions are not disclosed in the available data; users should confirm whether their installed instance matches the vulnerability’s scope by reviewing vendor documentation or contacting vendor support.

The CVSS v3 score is 8.7, indicating a high severity vulnerability. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild, although the lack of a known KEV listing does not guarantee absence of active exploitation. The attack vector is likely unauthenticated, via the publicly accessible upload.php endpoint, and requires path traversal inputs. If exploited, an attacker can run arbitrary code on the server.