PerfreeBlog version 4.0.11 is affected by an arbitrary file upload vulnerability that poses a significant risk of unauthorized system access to authenticated users.

The application fails to properly validate file types within the installTheme function, allowing an authenticated attacker to upload arbitrary files to the server. This flaw requires the attacker to have low-level privileges to interact with the theme installation mechanism.

The ability to upload arbitrary files to a web server typically leads to remote code execution, which can result in a total compromise of the application and its underlying server. With a CVSS score of 7.6, this vulnerability represents a high-severity risk that could lead to data exfiltration, lateral movement within the network, and significant reputational damage.

Immediate Action: Administrators should restrict access to administrative functions and verify if a security patch has been released by the vendor at https://perfree.org.cn/. If no patch is available, disable the theme installation feature to prevent exploitation.

Proactive Monitoring: Monitor server file systems for the creation of unexpected executable files or scripts, particularly within themes or upload directories. Review web server access logs for requests directed at the installTheme endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block suspicious file upload attempts or requests targeting theme installation paths. Ensure that the web server process runs with the least privileges necessary to limit the impact of a potential compromise.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up referenced in the CVE record.

Given the presence of a public proof-of-concept and the high-severity nature of arbitrary file upload flaws, this issue must be prioritized for remediation. Organizations should audit their PerfreeBlog instances immediately and apply any available vendor security updates to close this attack vector.