The vulnerability resides in Feelec‑Yishu FeelCRM OS 1.0.0 within the UploadTicketFile endpoint of UploadController.class.php. An attacker can manipulate the cmd argument to upload any file type without restriction, which could allow placement of malicious files on the webserver. The flaw reveals an improper authorization check and absence of file‑type validation, exposing the system to potential code execution or other attacks that exploit arbitrary file uploads. Based on the description, the attack vector is remote.

Feelec‑Yishu FeelCRM OS 1.0.0. The affected component is the UploadTicketFile endpoint handled by UploadController.class.php. No other versions were mentioned; this vulnerability applies to the cited version only.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is unknown, and the issue is not listed in CISA's KEV catalog. The vulnerability can be exploited remotely by sending crafted requests that alter the cmd parameter, enabling an attacker to upload arbitrary files. Remediation through an official patch would block the exploit; until then, the endpoint remains vulnerable to attacks that could lead to unauthorized code execution.