A flaw in the chunkUpload function of GouGuOA’s Api.php allows an attacker to manipulate the file_extension parameter to upload files without proper validation. The vulnerability can be exploited remotely, enabling an attacker to place arbitrary files on the server that may later be used for malicious code execution or other attack vectors. The CVSS score of 5.3 indicates moderate severity, with potential impacts on confidentiality, integrity, and availability depending on the attacker’s goals and the file types accepted.

The vulnerability affects GouGuOA software up to and including version 6.1.2. No other versions or release dates are specified. The issue resides in the app/disk/controller/Api.php component of the GouGuOA product suite.

The CVSS score of 5.3 reflects a moderate risk level. An exploit has been publicly released, signaling that attackers have discovered a method to abuse the flaw, although environmental or configuration constraints may limit immediate impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed high‑profile exploitation yet. The weakness is a combination of improper access control (CWE‑284) and accepting arbitrary file types (CWE‑434), thereby allowing remote exploitation through the API endpoint if the server does not enforce stricter validation.