A critical arbitrary file upload vulnerability in EverShop 2.0.1 allows unauthenticated attackers to execute malicious file uploads, posing a severe risk to system integrity and service availability.

The application fails to perform sufficient server-side validation on the /api/images endpoint, which is accessible to unauthenticated remote attackers by default. This flaw enables the upload of arbitrary file types, allowing attackers to inject malicious content or perform denial of service via disk space exhaustion.

Successful exploitation of this vulnerability allows an unauthenticated attacker to inject arbitrary files into the web server. This can lead to the deployment of phishing or credential-harvesting pages, causing significant reputational damage and potential loss of sensitive customer data. Given the CVSS score of 7.5, the risk of unauthorized file placement is considered high, necessitating immediate prioritization.

Immediate Action: As no specific patched version is currently provided, administrators should immediately restrict access to the /api/images endpoint via network-level controls or web server configuration to prevent unauthorized access.

Proactive Monitoring: Security teams should audit web server logs for suspicious POST requests directed at the /api/images endpoint and monitor disk utilization for sudden, anomalous spikes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block requests containing non-image file extensions or suspicious directory traversal attempts targeting the upload directory.

Public Exploit Available: Unknown (No confirmed public weaponized exploit or published PoC exists in the provided data).

The vulnerability presents a substantial risk due to the lack of authentication required to influence the server filesystem. Administrators must treat this as a high-priority incident and implement strict access controls on the vulnerable API endpoint until a vendor-supplied patch is identified and applied. Verification of the current directory structure for unauthorized files is highly recommended.