Precurio Intranet Portal 4.4 contains a cross‑site request forgery flaw that lets an attacker coerce an authenticated user to submit a carefully crafted request to a profile‑update endpoint. The endpoint accepts file uploads, and if the uploaded file contains executable code the server stores it in a web‑accessible directory, enabling the attacker to run arbitrary code with web‑server privileges. This weakness maps to HTTP request forgery and insecure file‑upload categories.

The only affected product listed is Precurio Intranet Portal version 4.4. No other major or minor versions are mentioned.

The flaw has a CVSS base score of 8.6, indicating high severity. The EPSS score is below 1 %, suggesting a low current probability of exploitation. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session that can be influenced to send a malicious file; once the file is uploaded to an executable directory, the attacker can achieve arbitrary code execution.