The flaw in funadmin’s Frontend Chunked Upload Endpoint allows an attacker to manipulate the 'File' argument in the chunkUpload function. By supplying a crafted request, the attacker can upload arbitrary files to the server without any restrictions. The vulnerability is classified under CWE-284 and CWE-434, and an attacker could use this to deploy malicious code, leading to potential remote code execution or persistence on the affected system.

The issue applies to funadmin versions up to 7.1.0-rc6. The affected component is UploadService.php in the Frontend Chunked Upload Endpoint. Administrators deploying any version of funadmin before the patch should be aware that the upload directory is writable by unauthenticated or low‑privilege users.

The CVSS base score of 6.9 indicates a moderate to high severity. The exploit is remote, with public proof‑of‑concepts available, but the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog. Adversaries can upload arbitrary files or potentially execute code if the uploaded content is later invoked. The attack vector is via the web interface’s upload endpoint, and successful exploitation requires network access to the target.