A vulnerability exists in the uploadFile function of the z-9527 admin component, specifically within the isImg Check module located at /server/utils/upload.js. The flaw arises from improper handling of the fileType argument, allowing an attacker to perform a path traversal attack that can lead to arbitrary file writes on the server. Remote exploitation is possible, which could enable the attacker to upload malicious files or overwrite critical configuration files, potentially resulting in unauthorized code execution or persistence on the affected system.

The affected product is z-9527 admin, with affected versions up to the commit hash 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2. Because the vendor follows a rolling release model, no specific version numbers are published for patched or unpatched releases. Systems running any iteration of the component before the fix defined by that commit are considered vulnerable. The vendor has not responded to notification.

The CVSS score of 5.3 indicates a moderate severity, and although EPSS data is unavailable, the vulnerability has been publicly disclosed and could be exploited remotely via the file upload endpoint without requiring authentication. The lack of a known patch and vendor inaction increase the risk of exploitation in the wild. As the vulnerability permits path traversal, an attacker could write files to arbitrary locations, which may lead to data compromise, configuration tampering, or execution of malicious code if the server subsequently processes those files.