Improper input validation and unrestricted upload of files with dangerous types in Gmission Web Fax enables remote code inclusion, allowing attackers to execute arbitrary code on the server. The flaw arises from insufficient checks on uploaded file types, permitting malicious payloads to be processed by the application.

Gmission Web Fax versions prior to 3.1, including 3.0 and earlier releases, are affected. The vulnerability is present in the default configuration of the application and impacts all instances without an applied patch.

The CVSS score of 8.6 indicates a high severity of remote code execution. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the lack of inclusion in the CISA KEV catalog does not diminish the potential risk. Attackers can exploit the flaw by uploading a crafted file through the web interface, triggering code execution on the server. Mitigating this risk requires timely deployment of the vendor’s patch, disabling file uploads when not needed, and enforcing strict file type validation at the web server level.