An uncontrolled file upload flaw allows attackers to upload arbitrary files with dangerous content. The flaw is due to missing or insufficient validation of the file type and location. An attacker who can trigger the upload can drop a web shell or other executable code onto the server, giving them remote code execution on the web server. This could lead to full compromise, data exfiltration, or destruction of information stored by the system.

Affected are installations of TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company's Software Repository Management module prior to the code commit 2fb4acee. The vulnerability exists in the repository’s upload endpoint used by authorized users for application binaries or documents. All users with write access to the repository are potentially at risk.

Severity is reflected in a CVSS score of 9.8, indicating critical risk. The EPSS score is not available, but given the high severity and the common nature of upload interfaces, the likelihood of exploitation should be treated as high. The vulnerability is not listed in the CISA KEV catalog; however, the likely attack vector is remote through the web application, requiring the attacker to either authenticate with an account that has upload rights or exploit a weakness that allows unauthenticated upload. Based on the description, it is inferred that the attacker could gain full control of the server by uploading a web shell.