The upload endpoint in xiweicheng TMS is vulnerable to unrestricted file uploads due to insufficient filename validation. An attacker can submit a crafted filename and payload, causing the server to store the file without restricting type or size. This flaw is aligned with CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type). If the uploaded file is executable or contains a malicious script, it could result in remote code execution, data tampering, or web defacement.

The vulnerability affects xiweicheng TMS versions up to and including 2.28.0. Users operating any supported release of the TMS product prior to a corrected version are at risk. No specific subcomponents beyond the FileController were identified as affected.

With a CVSS score of 5.3 the issue is of moderate severity, and the EPSS score of less than 1 % indicates a low incidence of exploitation in the wild. The problem is not listed in the CISA KEV catalog. The attack vector is remote; an attacker merely needs to transmit a malicious file to the upload endpoint. Because the system accepts arbitrary filenames and file types, a successful upload could allow later execution or compromise of the web application, meaning that the risk remains significant despite the low EPSS.