The TMS file upload endpoint fails to enforce server‑side file type restrictions, which allows an attacker to upload and execute arbitrary PHP files on the web server. This flaw permits full remote code execution, giving an attacker the ability to run any code with the same privileges as the web server process, compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects Toptech Systems' TMS7 and TopHAT products. All releases prior to 7.8 are vulnerable; the issue has been fixed in the 7.8 release, so any instance running an earlier version is at risk.

The CVSS score of 9.4 classifies this defect as critical. The EPSS score is not available, so the current failure‑to‑predict exploitation probability remains unknown, but the severity suggests a high likelihood if an attacker finds a path to the upload endpoint. The vulnerability is not listed in CISA KEV, yet the potential for remote code execution warrants immediate action.