OpenSTAManager versions 2.10 and earlier allow an attacker to upload arbitrary files through the module update upload endpoint. The flaw permits the replacement or addition of files on the server, potentially enabling execution of malicious code or tampering of application logic. The vulnerability falls under uncontrolled file upload weaknesses.

The affected product is OpenSTAManager, version 2.10 and earlier. No specific vendor information is provided. The vulnerability resides in the modules/aggiornamenti/upload_modules.php script used for module updates.

There is no publicly published CVSS score or EPSS estimate, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, arbitrary file upload is a high‑severity flaw and is often exploited when proper validation is missing. The likely attack vector requires the attacker to submit a crafted upload request to the vulnerable endpoint, which may be reachable over the network or via internal access depending on the deployment. If active, the flaw can lead to code execution, data compromise, or service disruption.