A bug in mingSoft MCMS 6.1.1 allows an attacker to manipulate the File argument of the /ms/file/uploadTemplate.do endpoint, leading to the ability to upload arbitrary files. The flaw stems from a missing validation routine, which permits any file type and size to be stored by the web application. If an uploaded file contains executable code or system configuration changes, this can result in remote code execution, defacement, or other compromise of confidentiality, integrity, or availability. The vulnerability is classified with CVSS 5.1, indicating a medium severity for the potential impact.

The vulnerability affects the mingSoft MCMS product, specifically version 6.1.1. No other affected versions are listed in the data provided.

The vulnerability is exploitable from a remote host via the uploadTemplate.do URL. While the empirical EPSS score is less than 1%, an exploit has already been published and may be in use. The CVSS score of 5.1 reflects the moderate impact; however, the lack of public KEV listing and low EPSS suggest that exploitation is currently uncommon but possible for actors with sufficient motivation and access to the application.