A flaw in the Criminal‑Management‑System’s home.php function allows an attacker to manipulate the upload parameter and bypass the move_uploaded_file check, enabling the arbitrary upload of files to the web server. It is inferred that the system does not validate the file type or enforce permission restrictions; because of this lack of validation, a malicious image or script can be stored in a directory accessible to the web server, effectively allowing the attacker to execute arbitrary code and compromise confidentiality, integrity, and availability of the application.

The vulnerability exists in the Criminal‑Management‑System developed by vraj404, affecting all releases up to the commit hash 2808d057e7ddc5295519a487365b0cacfd0ba8c4. The project follows a rolling release model, so no specific version numbers are listed as affected.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the public exploit references and the description of remote exploitation suggest that an attacker can achieve remote code execution from any network reachable to the application. It is inferred that an attacker can achieve remote code execution from any network reachable to the application.