Brave CMS, an open‑source content management system, contains an unrestricted file upload flaw within the CKEditor upload endpoint. The controller handling the uploads does not validate the MIME type or restrict the file name, allowing any file to be accepted. An attacker authenticated to the dashboard can thus upload a PHP script and execute it on the host, leading to full remote code execution and total compromise of the system.

The vulnerability affects Ajax30 releases of BraveCMS version 2.0 and later, specifically all releases prior to 2.0.6. Administrators should verify whether their deployed system runs a version older than 2.0.6. The fix is contained in BraveCMS 2.0.6 and newer releases.

The CVSS base score of 8.8 indicates high severity. EPSS is below 1%, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting a low probability of public exploitation at present. Nonetheless, the flaw requires authenticated dashboard access; once logged in, an attacker can upload arbitrary files without type validation, making exploitation straightforward for anyone with such credentials.