A flaw in the /api/admin/sys-file/upload endpoint allows any user to upload files without validation of type or extension. This creates a risk that malicious content can be stored on the server and later processed, potentially leading to data tampering or unauthorized disclosure. The weakness is classified as an improper access control and unrestricted file upload.

The vulnerability exists in the feiyuchuixue sz-boot-parent project up to version 1.3.2-beta. All releases before the patched 1.3.3-beta are affected; the issue was identified in the repository and the fix is available on the stated commit and release tag.

The CVSS base score of 5.3 indicates moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation, although public exploit code is available. Based on the description, the attack vector is inferred to be remote; attackers can remotely trigger the upload if the endpoint is reachable. The vulnerability is not listed in the CISA KEV catalog. The patch addresses the problem by implementing whitelist limits on allowed extensions and MIME types.