Unimall v4 contains a directory traversal flaw in the FileUploadController.local endpoint that permits overwrite or creation of arbitrary files. If an attacker can upload a crafted file to a writable location, the application may execute that file, giving the attacker control over the system. The vulnerability is a classic instance of path traversal, which compromises integrity and confidentiality of data and brings about total loss of system control. It exploits improper validation of upload paths and lack of file type restrictions.

The affected product is Unimall version 4. No other vendors or versions are listed. Because the CNA did not provide a vendor name, the impact applies to any installation using this version of Unimall regardless of deployment context.

With no EPSS score available, the exploitation probability cannot be quantified, but the flaw is sufficient to execute arbitrary code and it is not listed in the CISA KEV catalog. The likely attack vector involves remote interaction with the file upload interface, which is typically exposed over HTTP or HTTPS. Exploitation requires only upload privileges; once an attacker can submit a file to the vulnerable endpoint they can place malicious code in a location where the application will execute it. The CVSS score is not provided, so the exact severity is unknown, yet the potential impact is high.