A weakness in MacCMS Pro up to version 2022.1.3 allows an attacker to upload arbitrary files through the Plugin Installation Handler’s add.html interface. The vulnerability qualifies as Unrestricted Upload of File with Dangerous Type (CWE-434) and Improper Access Control (CWE-284), giving the attacker the ability to place malicious payloads on the server. If a script or web-shell is uploaded, remote code execution or file inclusion attacks may follow, violating confidentiality, integrity, and availability of the impacted application.

The affected system is MacCMS Pro, a content management platform. The flaw exists in the Plugin Installation Handler component, specifically the /admi.php/admin/addon/add.html endpoint, and it affects all releases up to and including 2022.1.3. No later versions were identified in the provided data.

The CVSS base score of 5.1 indicates a medium severity risk, but the public availability of an exploit and the ability to perform the attack from a remote location raise concerns. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remotely executed web request to the vulnerable endpoint, where an authenticated or unauthenticated attacker can upload files without restriction. An attacker can then execute or access the uploaded content, potentially leading to further compromise. The vendor’s lack of response creates a heightened risk that the flaw remains unpatched in production environments.