The vulnerability arises from an arbitrary file upload flaw in the ShopOrderImportController component, allowing attackers to craft a file that is executed on the server. This flaw directly enables remote code execution, granting attackers full control over the affected system. The weakness corresponds to poor handling of uploaded file types and is identified as CWE-434.

The flaw is present in the qihang-wms application, specifically in the commit identified as 75c15a. Because no vendor or product version information is supplied, the affected product is limited to this code base and its deployment environments. Users running this unpatched application are potentially exposed.

Exploitability is high since the flaw is triggered simply by submitting a malicious upload through the exposed endpoint. The CVSS score of 7.3 indicates a high severity, and the lack of validation and the direct execution path make it a priority target for attackers who can reach the upload interface over the network. The EPSS score is < 1%, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.