docuFORM Managed Print Service Client 11.11c has a flaw in pmupdate.php that allows the upload of any file type or content without validation. The vulnerability permits an attacker to place arbitrary files on the system by sending requests to the pmupdate.php endpoint, without restrictions on file type, size or format.

The only product affected is docuFORM Managed Print Service Client version 11.11c. No other vendors or product versions are listed as impacted in the available CNA data.

The CVSS score of 6.3 indicates a medium severity, reflecting the risk of having arbitrary files stored on the device. No EPSS data is available, so the likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is remote over HTTP/HTTPS, targeting the pmupdate.php endpoint, which may be reachable by any user who can access the service.