The a+HCM application by aEnrich suffers from an arbitrary file upload flaw that allows unauthenticated remote attackers to upload any file to any path on the server, including files with HTML extensions. This flaw is classified as CWE‑434. The ability to place arbitrary files, especially executable or HTML files, could lead to cross‑site scripting or other content‑injection attacks, potentially compromising the confidentiality, integrity, or availability of the application or the data it serves.

Affected customers are those running the a+HCM product from aEnrich. The advisory does not list specific vulnerable versions, so all installations that have not applied the vendor’s recommended update may be vulnerable. An inventory check is advised to determine the current version and exposure.

The CVSS base score of 5.1 indicates a moderate risk level. EPSS is not available, so the likelihood of exploitation is unclear, and the vulnerability is not currently listed in the CISA KEV catalog. Remote attackers can exploit the flaw without authentication, suggesting that the vulnerability should be prioritized for patching or mitigation.