Prior to version 10.1.0.0, the OPEXUS eComplaint application permits an attacker who does not need authentication to discover existing case numbers and then upload arbitrary files through the Portal/EEOC/DocumentUploadPub.aspx page. The uploaded files appear to legitimate users within the case folder and can be used to display unexpected content or to consume server storage when a large number of files are uploaded. The vulnerability is tied to improper handling of user input and lack of authorization checks as described by CWEs 425 and 639.

Any organization that runs OPEXUS eComplaint from OPEXUS Tech and uses a version older than 10.1.0.0 is affected. The vendor product name is OPEXUS eComplaint and all releases before 10.1.0.0 lack the necessary controls to validate the case identifier before accepting an upload.

With a CVSS score of 5.3 the issue is considered moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, meaning no known public exploits have been documented. Attackers still require knowledge or ability to guess a valid case number, but if they succeed they can place malicious files or exhaust storage. The overall risk is moderate but mitigated by the need for case discovery and the low exploit prevalence.