Mothra naïvely accepts a default value supplied by a website for the path field in HTML file upload forms. An attacker can craft a page with a malicious default file path, hide the form element, and cause the user’s browser to submit a file to that path. This lack of validation enables the attacker to overwrite arbitrary files, potentially compromising the integrity of the system and enabling execution of harmful code. The weakness is a form of unchecked input handling, consistent with path‑traversal or improper validation of default values for file uploads.

The vulnerable component is part of the 9front operating system, specifically the Mothra viewer. No specific version information is supplied in the advisory, so all releases of 9front that include Mothra are potentially affected until a patch is provided.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of < 1% indicates a very low probability of exploitation. Safeguards are not currently listed in CISA’s KEV catalog. The likely attack vector requires an unsuspecting user to load a malicious web page that prompts the upload form; the user’s interaction is necessary for the payload to be written to the chosen location. The vulnerability could lead to unauthorized file modification and potential code execution, depending on the target file’s role in the system.