DreamMaker, produced by Interinfo, has an arbitrary file upload flaw that allows privileged remote attackers to upload web shell backdoors. By placing an executable file on the server through the upload mechanism, an attacker can then run that code, effectively gaining full control of the affected system.

All installations of Interinfo DreamMaker are potentially impacted, especially those that have not applied the latest update. No specific version list is provided, so all product releases should be reviewed for the applied security patch.

The vulnerability carries a CVSS score of 8.6, indicating a high severity level. Because the upload functionality is exposed remotely without additional authentication in the description, the likelihood of exploitation is significant. Although EPSS data is not available, the presence of a remote, privileged upload path suggests a realistic attack vector. The issue is not listed in CISA’s KEV catalog, but the high CVSS score and nature of the flaw warrant urgent attention.