The flaw lies in the FileLibraryController::storeFile method of AREA 17 Twill CMS through version 3.6.0. It allows an attacker to submit a file with an arbitrary filename via the media library upload endpoint, bypassing the CMS’s normal restrictions on file content or name. The underlying weaknesses are a lack of proper authorization checks (CWE‑284) and inadequate validation of file types and names (CWE‑434). The consequence is that the CMS can receive any file, potentially exposing sensitive data or allowing execution of malicious content if the file is later processed by privileged users.

AREA 17 Twill CMS installations running any version up to 3.6.0 are susceptible. The affected component is the Media Library in the admin area. Administrators of these deployments should verify whether they are on a vulnerable version and whether a newer release resolves the issue.

The computed CVSS score of 5.1 indicates moderate severity. The EPSS score is less than 1 %, implying that large‑scale exploitation is unlikely at present, and the vulnerability is not currently listed in CISA’s KEV catalog. According to the description, the upload endpoint can be accessed remotely; the requirement for authentication is not explicitly stated, so it is inferred that the endpoint may be callable without prior login. Once an arbitrary file has been uploaded, an attacker could later attempt to trigger its execution if the CMS serves files without additional safeguarding.