technical-laohu mpay’s QR Code Image Handler can be made to upload files without restriction. By manipulating the codeimg argument, an attacker can upload arbitrary files to the server via a remote request. The sole information provided states that the upload is unrestricted, implying that the server may accept dangerous file types and execute them, which could lead to a compromise of confidentiality, integrity, and availability. The vulnerability does not claim any privilege escalation beyond what the uploading actor already possesses, but the lack of validation is a significant weakness.

Versions of technical‑laohu mpay up to and including 1.2.4 are affected. The vulnerable component is an unknown function within the QR Code Image Handler of this product. No other versions are mentioned, so the risk is confined to the stated release range.

The CVSS base score is 5.1, indicating moderate severity, and the EPSS score is below 1%, showing a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no official solution or workaround is published. Based on the description, the likely attack vector is remote, through a crafted HTTP request that supplies a malicious file via the codeimg parameter. Because the flaw permits uploading arbitrary files, an attacker could potentially place payloads that are later executed or used for data exfiltration, depending on the server’s configuration.