Description
A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted file upload allowing arbitrary file delivery and potential code execution
Action: Assess Impact
AI Analysis

Impact

A flaw in the /Report/Upload/UploadFormImg.ashx handler of Beijing Meite Software Technology’s U+Smart Enjoyment WebSite permits an attacker to manipulate the File argument and upload files without any restrictions. This vulnerability can be exploited remotely, enabling the delivery of arbitrary files, including executable code, which may lead to further compromise of the host system. The weakness maps to access‑control and unrestricted upload defects identified by CWE-284 and CWE-434, respectively.

Affected Systems

Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000 is known to contain the flaw; no other affected versions are listed in the current data.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity level. EPSS data is unavailable, and the vulnerability does not appear in the CISA KEV catalog. Because the attack can be launched from a remote source via the publicly exposed upload endpoint, the likelihood of exploitation depends on the site’s exposure and any existing countermeasures. The risk remains moderate until a vendor update is applied or mitigation controls are implemented.

Generated by OpenCVE AI on September 7, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Implement server‑side validation that restricts uploads to approved file types and extensions, rejecting or quarantining all other uploads.
  • Restrict access to the /Report/Upload/UploadFormImg.ashx endpoint using firewall rules, IP whitelisting, or authentication so that only authorized administrators can reach it.
  • Monitor file upload activity and log incidents to detect potential abuse of the unrestricted upload endpoint.

Generated by OpenCVE AI on September 7, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload
First Time appeared Beijing Meite Software Technology
Beijing Meite Software Technology u Smart Enjoyment Website
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:beijing_meite_software_technology:u_smart_enjoyment_website:*:*:*:*:*:*:*:*
Vendors & Products Beijing Meite Software Technology
Beijing Meite Software Technology u Smart Enjoyment Website
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Beijing Meite Software Technology U Smart Enjoyment Website
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:43:00.484Z

Reserved: 2026-09-06T12:51:59.441Z

Link: CVE-2026-86272

cve-icon Vulnrichment

Updated: 2026-09-08T13:42:56.314Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T05:16:55.387

Modified: 2026-09-08T14:17:33.600

Link: CVE-2026-86272

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:24:20Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type