MeetingHub by HAMASTAR Technology contains an arbitrary file upload weakness that allows unauthenticated remote attackers to upload and execute arbitrary code on the server. The flaw can be exploited by submitting a malicious file to a publicly exposed endpoint, effectively granting the attacker full control over the application environment.

The vulnerability affects installations of the MeetingHub product from AMASTAR Technology. No specific version range is provided beyond the vendor’s recommendation; the vendor recommends applying the patch released on 20251210 or later to resolve the issue.

The CVSS base score is 9.3, indicating a high severity vulnerability. The EPSS score is less than 1%, implying a low probability of exploitation in current use. The vulnerability is not listed within the CISA KEV catalog. Attackers can exploit the flaw over the network without authentication, uploading a malicious payload to the vulnerable endpoint and executing it with the privileges of the web application.