The vulnerability exists in the file upload feature of Census CSWeb version 8.0.1, allowing a remote, authenticated attacker to upload arbitrary files. If a malicious file is successfully uploaded and executed, the application may run arbitrary code, leading to remote code execution. The weakness corresponds to improper validation of uploaded content, as defined by CWE-434.

Customers running Census CSWeb version 8.0.1 are vulnerable. The issue is present in the cpe:2.3:a:csprousers:csweb:8.0.1 product. The fix is available in version 8.1.0 alpha or later; any deployment still at 8.0.1 or earlier without the patch remains susceptible.

The CVSS score of 8.7 indicates high severity, while an EPSS score of less than 1% suggests limited current exploitation activity. The vulnerability is not listed in CISA KEV. Based on the description, the attack requires remote access and valid authentication to upload files; once a malicious file is uploaded, it could be executed on the server.