An uncontrolled search path element in the package upload feature of Chaos Software V-Ray Swarm enables attackers to redirect the system into loading libraries from arbitrary locations, thereby executing arbitrary code. The flaw does not require authentication; once a malicious package is uploaded, the server processes it without validating the path of referenced libraries, granting execution privileges to the attacker.

All installations of Chaos Software V-Ray Swarm up to and including version 2.0.19 are affected. The vendor product is Chaos Software V-Ray Swarm, with vulnerable releases enumerated as 2.0.19 and earlier.

The CVSS score of 9.3 indicates a high severity and the flaw is exploitable by anyone who can reach the upload endpoint. Because authentication is not required, the attack vector is likely the remote upload of a crafted package, a path that can be abused to execute code without user interaction. Although the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, the combination of unrestricted access and arbitrary code execution makes exploitation highly probable and intentionally damaging to confidentiality, integrity, and availability of the host running V-Ray Swarm.