A vulnerability in the FreeMarker Template Handler of bolo-blog bolo-solo permits an attacker to upload arbitrary files because the PicUploadProcessor does not validate the uploaded file type or name. This flaw is a classic example of improper authorization (CWE‑284) and unrestricted file upload (CWE‑434). This unrestricted upload capability can allow the placement of malicious script files on the server, potentially leading to remote code execution or other serious compromises. The defect is coded in the PicUploadProcessor.java file used by versions up to 2.6.4.

The issue affects the bolo-blog bolo-solo platform version 2.6.4 and earlier. The vulnerable component is the PicUploadProcessor that processes file uploads within the FreeMarker Template Handler. No other versions or modules are explicitly listed as impacted in the current data.

The CVSS score is 5.3, indicating moderate severity. EPSS is reported as < 1%, suggesting low exploitation probability at present, but the exploit has been made public, so an attacker could still attempt it without much effort. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely by sending crafted upload requests; no local privileges or complex prerequisites are required. Because it allows uploading of any file type, there is a tangible risk of executing arbitrary code on the web server if the uploaded file is a script.