A vulnerability exists in the check_userinfo function within Diyajax.php of EyouCMS, where the viewfile parameter is not properly validated. This allows an attacker to upload arbitrary files without restriction, and based on the description, it is inferred that such files could be executable and lead to remote code execution. The flaw is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

The affected product is EyouCMS, specifically versions 1.7.0, 1.7.1, and 5.0, as well as any earlier builds that incorporate the vulnerable check_userinfo implementation. No other vendors or products are listed as affected.

The CVSS score of 5.3 indicates medium severity, while the EPSS value of less than 1% suggests a low likelihood of exploitation. Based on the description, it is inferred that the flaw can be exploited remotely without authentication. After a file is uploaded, it is inferred that the file could be executed, potentially giving attackers control over the application. Although the vulnerability is not yet listed in the CISA KEV catalog, publicly available proof‑of‑concept code means a rapid deployment of an exploit is possible if the issue remains unfixed. Monitoring for unusual upload activity and applying defensive measures is advised until a patch is applied.