The flaw resides in the save_files function of oretnom23 file‑management‑system‑php. By manipulating the Upload argument, an attacker can upload any file type, including executable scripts. This can lead to arbitrary file injection and, if the uploaded content is a web script, remote code execution on the server. The weakness is an example of CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

The vulnerability affects oretnom23 file‑management‑system‑php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Because the project follows rolling releases, exact release numbers for the fix are not documented, but any installation before that commit is vulnerable.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog, yet an exploit has already been published, showing that an attacker can trigger the flaw remotely by altering the Upload parameter in a request to the admin_class.php endpoint. The description does not specify authentication prerequisites; based on the wording it is inferred that the attack can be launched from outside the system, implying limited or no authentication requirements on the upload endpoint.