This flaw allows attackers to upload arbitrary files through the Widget Editor component of diem, bypassing all validation checks. The vulnerability stems from missing access controls and unverified file uploads, as identified by the associated CWE-284 and CWE-434 weaknesses. A successful exploit can place malicious files on the server, which may subsequently be executed or used to compromise other system components, depending on the file type and server configuration.

The issue affects the diem project (diem) through version 5.1.3, specifically the dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php file within the Widget Editor. Users running any release up to and including 5.1.3 are exposed; upgrading beyond this version removes the vulnerability.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA KEV. The attack vector is remote, as an adversary can trigger the upload via the web interface without local system access. Public exploit code has been released, increasing the risk that a determined attacker will deploy the flaw against vulnerable installations. The lack of a vendor-issued fix means the window for exploitation remains open until a patch is applied or mitigated.