The vulnerability in Wertheim SafeController Software arises from insufficient server‑side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application accepts uploads based on the user‑controlled HTTP Content‑Type header, allowing any authenticated user to spoof the header and upload arbitrary files. The description implies that if an uploaded file is later interpreted or executed by the system, it could result in code execution or other damage; this potential impact is inferred from the description.

The affected product is Wertheim GmbH’s SafeController Software for VAULT ROOMS (Safe Deposit Locker System), AssemblyVersion 6.15.8328.28014. No fixed‑version information is publicly disclosed; the vulnerability applies to all installations that expose the upload API without the vendor's corrective patch.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. The exploit requires authentication but does not require privilege escalation; any authenticated user can upload arbitrary files. While the vulnerability itself is not immediately exploitable into remote code execution, the description indicates that uploading executable content could lead to execution once processed. The workaround mitigates some risk by restricting access and enforcing stricter validation, but the most secure remediation is to apply the vendor patch as soon as it is released.