An authenticated user can upload any file type to Windu CMS because the system does not validate the file type. If a malicious user uploads a PHP script or other executable file, the web server may execute it, giving the attacker remote code execution capabilities. The flaw originates from a lack of input validation, which is a known weakness classified as CWE-434.

Windu CMS version 4.1 has been confirmed to be vulnerable. The advisory notes that other, earlier or later releases may also be affected, but no specific versions have been enumerated beyond the confirmed 4.1 release.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user; the flaw does not allow unauthenticated file uploads. The security impact is full remote code execution, which can compromise the integrity and confidentiality of the affected system.