A flaw in the SysFileController component of ZS-Admin permits remote clients to upload any file to the /api/system/file/upload endpoint without validation. The vulnerability is classified as CWE-284 (Authorization) and CWE-434 (Unrestricted Upload of File), and the description states it can be triggered remotely with publicly released exploitation code. If an attacker uploads a malicious file, it could be used to compromise the host’s confidentiality, integrity, or availability when the file is later executed or processed by the application.

It is inferred that all currently available releases of the ZS-Admin application (vendor zsadmin2025) are affected because the project follows a rolling release model and no fixed-version fix is available. Consequently, any deployed instance that exposes the /api/system/file/upload endpoint remains vulnerable until an official update is released.

The CVSS score of 5.3 indicates moderate impact, while the EPSS score of < 1% shows a low overall likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but exploitation code has already been publicly released. An attacker can invoke the flaw remotely without local privileges, making the risk significant for environments that permit file uploads. The threat persists until a mitigation or patch is applied.