The vulnerability permits an unauthenticated user to upload any file type, including potentially dangerous executables, to any location on the server where the web server user has write permissions. The impact can include file overwrite, deletion, or execution, leading to remote code execution and significant confidentiality, integrity, and availability compromise.

The affected product is PuMuKIT from the vendor PuMuKIT. All current versions of the application are impacted; no specific version constraints are listed in the available data.

With a CVSS score of 8.8, the condition is high severity. The EPSS score is not available, indicating uncertainty about current exploitation frequency. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been linked to known exploits. Likely attack vectors involve crafting an HTTP request that submits a file with a dangerous extension, bypassing any server-side type checks, and then using the web server's write permissions to place the file on the filesystem. If the server processes these files, remote code execution or further file manipulation can occur.