Priority Web versions 23.0 and below are susceptible to an unrestricted file upload vulnerability that poses a significant risk of remote code execution.

The application suffers from an unrestricted upload of file with dangerous type (CWE-434), which allows an authenticated user to bypass file validation mechanisms. By uploading malicious files, an attacker can achieve unauthorized code execution within the context of the web server.

Successful exploitation of this vulnerability allows an authenticated attacker to compromise the integrity and availability of the Priority Web platform. Given the high CVSS score of 8.8, this flaw represents a major security risk, as it can lead to full system takeover and the potential exfiltration of sensitive organizational data stored within the ERP environment.

Immediate Action: Upgrade your Priority Web installation to the latest available version provided by the vendor to eliminate the file upload vulnerability.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or attempts to access non-standard file extensions within upload directories.

Compensating Controls: Implement strict file type validation at the Web Application Firewall (WAF) level to block the upload of executable scripts or suspicious file types to the server.

Public Exploit Available: No

The presence of an unrestricted file upload vulnerability in an enterprise ERP system like Priority Web constitutes a high-severity risk. Security teams should prioritize identifying all instances of the software within their infrastructure and apply the latest vendor patches immediately. If an update cannot be performed today, ensure that file upload directories are configured with execute permissions disabled to mitigate the impact of a potential incident.