The vulnerability resides in the DocumentController of OpenBoxes up to version 0.9.1, allowing any remote attacker to upload arbitrary files because the controller lacks proper validation or access controls. This flaw, classified as CWE‑284 and CWE‑434, can enable the attacker to place malicious files such as web shells or data exfiltration tools on the server, potentially leading to remote code execution, data tampering, or denial of service.

OpenBoxes; the flaw affects all installations of OpenBoxes 0.9.1 and earlier. The update that mitigates the problem is version 0.9.2, which includes commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. No other vendors or product lines are currently listed as affected.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation as of the last data release. The flaw is exploitable remotely; an attacker simply needs to send a crafted upload request to the DocumentController endpoint, which will accept and store the file without restriction. Because the upload functionality is publicly reachable, the attack path is straightforward and does not require privileged credentials, increasing the potential risk for exposed systems.