In shiroiAdmin versions 1.1 and 1.3, the FileController::upload method accepts a resource named File that is not validated for type or location. This flaw allows a remote actor to upload arbitrary files to the server via the upload endpoint. The vulnerability is related to CWE-434 for unrestricted upload and CWE-284 for insufficient access control. By placing a script, executable, or other malicious content, the actor could gain further foothold or trigger unauthorized code execution if the uploaded content is later served or accessed. The impact is therefore a potential full compromise of the application or underlying system if the uploaded files are executable.

The product hcr707305003 shiroiAdmin is affected. The specific vulnerable releases are 1.1 and 1.3. A vendor‑supplied patch is available in release 1.4 (commit 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70), which removes the validation flaw. Any deployment still running 1.1 or 1.3 should be upgraded to 1.4 or later immediately. No other versions are known to be affected.

The CVSS score of 6.9 labels this vulnerability as moderate severity. An EPSS score of less than 1% indicates a very low likelihood of widespread exploitation at present. The vulnerability is not currently listed in CISA’s KEV catalog. The attack can be performed remotely by sending a crafted request to the file upload endpoint. While the CVSS score is moderate, the unrestricted nature of the upload provides a clear path for attackers to inject and potentially execute malicious files, which could result in a complete compromise of the target system if the application or webserver allows execution of files in the upload directory.