Contentstudio is vulnerable to an unrestricted file upload flaw that allows remote attackers to execute arbitrary code via web shell deployment.

This is an unrestricted file upload vulnerability that permits an unauthenticated attacker to upload malicious files, specifically web shells, directly to the web server to achieve remote code execution.

The ability to upload a web shell grants an attacker full control over the web server, leading to potential data exfiltration, lateral movement within the network, and complete system compromise. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could lead to significant operational downtime and severe reputational damage.

Immediate Action: Identify and update the Contentstudio installation to the latest available version provided by the vendor.

Proactive Monitoring: Inspect web server logs for suspicious POST requests targeting upload directories and monitor for the creation of unauthorized executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing unauthorized file extensions or signatures indicative of web shell attempts.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to prevent unauthorized remote access. Administrators should prioritize patching their Contentstudio instances and review server configurations to ensure that upload directories do not permit the execution of scripts.