Cadmium CMS version 0.4.9 is susceptible to arbitrary file uploads, presenting a critical risk of full system compromise through remote code execution.

The application fails to properly validate file uploads within the /admin/content/filemanager/uploads endpoint. An unauthenticated attacker can bypass existing security controls to upload malicious files, which can then be executed by the server.

The ability to upload and execute arbitrary files provides an attacker with complete control over the web server. With a CVSS score of 9.8, the potential for data exfiltration, system defacement, or the installation of persistent backdoors is extremely high, posing a severe threat to business operations.

Immediate Action: As no official fix is currently listed, administrators should immediately restrict access to the /admin/content/filemanager/uploads directory to authorized personnel only via network-level controls.

Proactive Monitoring: Review web server access logs for suspicious file upload activity or requests targeting the file manager endpoint that do not originate from known administrative sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable extensions (e.g., .php, .exe, .sh) or suspicious MIME types to prevent exploitation.

Public Exploit Available: Unknown

Given the lack of an official patch, the risk must be mitigated through strict access control and WAF filtering. Organizations should monitor for updates from the Cadmium CMS maintainers and apply the official fix as soon as it becomes available.