An issue in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code by uploading a malicious file to the publicly accessible report.php component. The flaw stems from improper authorization checks (CWE‑639), enabling the attacker to bypass restrictions on which files may be processed. If successfully exploited, the attacker gains the ability to run arbitrary code on the underlying server, resulting in full compromise of confidentiality, integrity, and availability for the affected system. The likely attack requires no authentication, but this is inferred from the text rather than explicitly stated.

The only product explicitly cited is docuForm GmbH Client 11.11c. No other vendors or versions are mentioned in the CNA data. newer or older releases are not confirmed as affected pending further vendor information.

The CVSS score of 8.1 classifies the vulnerability as high severity. The EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely exploit it through a simple file‑upload request to report.php; the absence of authentication is inferred from the description but not explicitly stated in the CVE data, making the attack path straightforward once a malicious file is crafted.