An attacker can upload a file of a dangerous type to the file upload function of Interinfo DreamMaker. The file is treated as a legitimate class file and executed by the system, allowing the attacker to run arbitrary system commands. The weakness is identified as CWE‑434, which indicates a failure to restrict the type and usage of uploaded data.

Internet Information Co., Ltd. DreamMaker versions released prior to October 22, 2025 are affected by this flaw. No specific build numbers are listed, so all instances before that date fall within the impacted scope.

The flaw carries a CVSS score of 10, marking it as critical. The EPSS score is less than 1%, suggesting that, while the vulnerability is severe, its exploitation probability is relatively low at present. It has not been added to the CISA KEV catalog. Attackers can exploit the vulnerability remotely by simply uploading a crafted file; no special configuration or local privilege is required. Because the flaw permits arbitrary command execution, its exploit would provide full control over the affected system, with potential breach of confidentiality, integrity, and availability.