An exploitation vector exists in the Electronic Archives System’s uploadFile.html endpoint that allows an attacker to supply a manipulated File parameter to upload arbitrary content without restriction. The flaw falls under Access Control (CWE-284) and Unrestricted Upload of Dangerous File (CWE-434); if exploited, the attacker could place malicious files on the web server and potentially execute code, compromising the system’s confidentiality, integrity, or availability. The issue is highlighted as a remotely launchable attack, meaning an adversary does not need local access or elevated privileges to trigger the upload.

Tsinghua Unigroup’s Electronic Archives System, versions up to 3.2.210802(62532), is affected. The vulnerability is located in a currently unidentified function within /Archive/ErecordManage/uploadFile.html. No other versions or vendors are listed, so the scope appears limited to this product line and the specified releases.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and an EPSS score of less than 1% suggesting that exploitation is currently unlikely but cannot be ruled out. It is not listed in CISA’s KEV catalog, and the vendor has not yet responded to the disclosure. Because the flaw can be triggered remotely by supplying a specially crafted file argument, an attacker can likely deliver arbitrary files to the server without authentication, making the vulnerability immediately actionable for exploitation.