A weakness in Dcat-Admin up to version 2.2.3-beta allows an attacker to override the editormd-image-file parameter via the /admin/dcat-api/editor-md/upload endpoint. The request can serialize arbitrary files without validating type or size, giving the attacker unrestricted upload capability. The attack can be initiated remotely, and the exploit is publicly available and could be used for attacks.

The vulnerable component is the Dcat-Admin web application’s User Setting page. Versions up to 2.2.3-beta are affected. Affected vendors/products: Dcat-Admin. No later versions have been confirmed as unaffected, so any deployment using 2.2.3-beta or earlier should be evaluated.

The CVSS score of 5.1 indicates moderate impact. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. However, the publicly available exploit file demonstrates that the vulnerability can be used in real attacks. Based on the description, it is inferred that the upload endpoint is reachable without additional authentication beyond normal login, but the specific authentication requirements are not explicitly stated. The potential impact is significant in scenarios where the upload endpoint is exposed to untrusted users, as unrestricted file upload could lead to code execution, defacement, or further compromise. Administrators should consider immediate remediation.