An improper access control flaw within the /ThemeAndWidgets.xhtml page of the Dataverse Theme Customization component permits an attacker to manipulate the uploadLogo parameter and upload files without any restriction on type, size, or location. The weakness aligns with CWE‑284 and CWE‑434. By uploading a malicious script or binary, an attacker may host arbitrary code on the server, potentially enabling further compromise if the uploaded file is executed or accessed by privileged users.

Harvard University IQSS Dataverse versions up to 6.8 are affected, as the flaw was identified in those releases. The vendor released Dataverse 6.10, which removes the unrestricted upload capability from the Theme Customization feature. No other products or components were noted as impacted.

The CVSS score of 5.3 indicates a moderate severity. The vulnerability can be exploited remotely via a web request to the /ThemeAndWidgets.xhtml endpoint, likely by unauthenticated users, as the advisory does not reference authentication requirements. Publicly available exploits confirm that attackers can reach the upload functionality over the network without credentials. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the existence of a public exploit and the lack of upload restrictions elevate the risk for systems that rely on the Theme Customization feature.