Unimall v4 contains a directory traversal flaw in the FileUploadController.local endpoint that permits overwrite or creation of arbitrary files. If an attacker can upload a crafted file to a writable location, the application may execute that file, giving the attacker control over the system. The vulnerability is a classic instance of path traversal, which compromises integrity and confidentiality of data and brings about total loss of system control. It exploits improper validation of upload paths and lack of file type restrictions.

The affected product is Unimall version 4. No other vendors or versions are listed. Because the CNA did not provide a vendor name, the impact applies to any installation using this version of Unimall regardless of deployment context.

With an EPSS score of < 1%, the probability of exploitation is very low, but the flaw still permits arbitrary code execution and it is not listed in CISA KEV. The likely attack vector involves remote interaction with the file upload interface, typically exposed over HTTP or HTTPS. Exploitation requires only upload privileges; an attacker that can upload a crafted file can place malicious code in a location where the application will execute it. The CVSS score of 7.5 indicates a high severity, so the potential impact remains significant.