The vulnerability allows an attacker to upload arbitrary files, including executable or script files, through WEOLL’s unprotected upload interface. Because the system does not validate the file type or enforce content checks, an attacker can place malicious payloads that, when later accessed or executed, can lead to remote code execution or compromise the server. The weakness is categorized as CWE-434: Unrestricted Upload of File with Dangerous Type.

The issue affects Global IT Informatics Services Inc.’s WEOLL product across all releases starting at version 2.0.9 and continuing up to, but excluding, version 3.2.45.33. System administrators should verify whether their installations fall within this window and plan an upgrade accordingly.

The CVSS score of 8.7 signals high severity and combined with the fact that uploading functionality is not properly constrained by access control lists, the potential attack surface is substantial. An attacker who can reach the upload endpoint—whether through an authenticated session, phishing, or by exploiting another weakness—can upload a malicious file and later trigger its execution, resulting in full compromise of the managed environment. Although the EPSS score is not available, the lack of current exploits in public databases and the absence from the KEV catalog do not mitigate the inherent risk of an immediate local exploitation path.