An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that is not an official patch. The lack of validation means the system will accept and store files with arbitrary content, raising the risk that a malicious file could be executed or used to facilitate further compromise of the server or its users. The nominal CVSS score of 1.8 indicates low overall severity, yet the impact of an uploaded malicious payload can be severe if it is leveraged for code execution or data exfiltration.

The vulnerability affects the Genian SSL PNS products from Genians, Inc, specifically the frodo-core module and the watchcat-ui module. The known remediation is to upgrade both components to version 5.0.0; no explicit affected-version range was provided beyond the upgrade requirement.

The low CVSS score and lack of an EPSS value suggest that the vulnerability is not widely exploited yet, and it may require authenticated access to the upload endpoint. However, the RFC‑defined upload interface does not enforce file type or checksum verification, so once an attacker can reach the upload path, a malicious file can be placed on the system. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation. Nonetheless, given the potential for arbitrary code execution, the risk to confidentiality and integrity remains significant if exploited.