A flaw in the add_post.php script of mjperpinosa stumasy allows an attacker to manipulate the up_file_to_post argument and upload arbitrary files without restriction. This can enable the placement of malicious scripts or executables on the server, potentially granting the attacker remote code execution capabilities. The vulnerability is identified as an access control weakness and an unsafe file upload flaw.

The issue affects the mjperpinosa stumasy application as a whole. Because the project adopts a rolling release model, specific version information is unavailable and any current release could be vulnerable until a fix is applied.

The CVSS score of 5.3 denotes a medium severity risk. EPSS data is not available, so the estimated exploit probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack can be launched remotely and that a public exploit exists, which indicates a non‑trivial chance of exploitation if the flaw is not remediated.