Datiphy Data Management Center versions v8.3.0 through v8.5.1 contain a missing authentication check in the upload API endpoint, allowing an unauthenticated remote attacker to execute an arbitrary file upload to the server’s configured upload directory. This flaw falls under the Common Weakness Enumeration CWE‑306, which represents authentication failures. By uploading malicious files, an attacker can potentially gain code execution or upload malware that may later be executed by users or other services.

Affected systems are Datiphy Inc.’s Data Management Center product. The vulnerability spans all releases from v8.3.0 to v8.5.1, any instance that still uses these versions without a patch is vulnerable. The upload endpoint is exposed over the network and does not require any form of user authentication.

The CVSS score of 8.8 indicates high severity, and the absence of EPSS data means the exploitation probability cannot be precisely quantified. The vulnerability does not yet appear in the CISA KEV catalog, but its impact and lack of authentication make it a prime target for attackers seeking to upload arbitrary files. Exploitation requires no special privileges; any remote host that can reach the API can upload files, and the upload location may lead to executable code execution if accessible.