A weakness in the SysFileController within the glowxq-oj web application allows attackers to upload arbitrary files without server‑side validation. This flaw, identified in all releases up to commit 6f7c723090472057252040fd2bbbdaa1b5ed2393, maps to CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type). If a malicious file is subsequently executed by the application, the attacker could achieve remote code execution or otherwise compromise confidentiality, integrity, or availability of the system.

All instances of the glowxq:glowxq-oj product are impacted, as the vendor does not employ a standard versioning scheme. Because the code base up to the referenced commit is known to be vulnerable and no later release has been confirmed as fixed, any deployment of glowxq‑oj containing that commit or earlier is at risk.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting a relatively low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog, but exploit material has been made publicly available. The attack vector is remote, exploiting the web application’s upload endpoint; achieving remote code execution depends on whether the uploaded file is executed by the application or the environment.