Brave CMS contains an unrestricted file upload flaw in its CKEditor endpoint. Before version 2.0.6 the endpoint accepts any file type, including executable scripts. An attacker who can reach this endpoint can store a malicious payload on the server and subsequently execute it, giving full control over the host. This flaw is mapped to CWE‑434, improper restriction of file type. The impact is a potential full system compromise, data loss, or denial of service.

All installations of Ajax30 BraveCMS that are running any release prior to version 2.0.6 are vulnerable. The issue was resolved in the 2.0.6 update; no versions 2.0.6 or newer are affected.

The CVSS base score of 9.3 indicates critical severity. The EPSS score of less than 1% suggests that exploitation is not widespread at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote via the web‑based CKEditor upload interface, which would require the attacker to have at least some access to the CMS front‑end. Once this access is achieved, the flaw can be exploited without additional privilege escalation.