The vulnerability in mjperpinosa stumasy allows an attacker to upload files without restriction by manipulating the pr_profile_image parameter in change_profile_image.php. Because the application accepts arbitrary files and lacks proper validation, it permits the injection of malicious scripts or executables. This can lead to Remote Code Execution or other unauthorized actions, representing a significant confidentiality, integrity, and availability risk. The weakness corresponds to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

The affected product is mjperpinosa stumasy, which is maintained on a rolling‑release model and does not provide explicit versioned releases. All deployed instances of stumasy that include the change_profile_image.php module are potentially impacted, regardless of the build or deployment date.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests no known widespread exploitation yet. However, the vulnerability is publicly disclosed and can be triggered remotely, meaning that any user with access to the profile image upload endpoint could upload a crafted file. If the web server or application permits execution of the uploaded content, an attacker could gain remote code execution. Even without execution, the ability to place arbitrary files can be used for phishing, data exfiltration, or persistence. The risk is therefore non-negligible and warrants active mitigation.