A flaw in saithink/saigroup SaiAdmin versions up to 5.0.1 allows an attacker to upload arbitrary files through the Plugin Upload Endpoint without proper validation or authorization checks. The endpoint invokes shell_exec on the uploaded file path, enabling the execution of arbitrary code on the server. This flaw combines improper authorization (CWE‑284) and unrestricted file upload (CWE‑434), resulting in remote code execution.

The vulnerability impacts SaiAdmin from the vendors Saigroup and Saithink and affects all releases up to and including version 5.0.1. Any installation of these products that has not been updated beyond 5.0.1 is potentially vulnerable.

The CVSS score is 5.1, indicating a moderate severity when evaluated against the nominal attackability and impact curves. The EPSS score is not available, implying no publicly reported exploitation data or low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote, where an adversary can trigger the upload endpoint from a network reachable host and achieve code execution on the target system.