This critical remote code execution vulnerability in Omnispace Agora Project allows unauthenticated attackers to gain full system control via malicious file uploads.

This is an unauthenticated file upload vulnerability that leverages the MSL engine within the Imagick library. An attacker can submit a crafted PDF file to the application's upload or thumbnail functions to trigger arbitrary code execution on the underlying server.

The ability for an unauthenticated attacker to achieve remote code execution represents the highest level of security risk. A successful exploit could lead to complete server takeover, unauthorized data exfiltration, and lateral movement within the network. The 9.8 CVSS score reflects the ease of exploitation and the critical impact on system integrity.

Immediate Action: Update the Agora Project software to version 25.10 or later to ensure the vulnerable file upload handling mechanism is remediated.

Proactive Monitoring: Inspect web server logs for suspicious POST requests targeting upload endpoints and monitor for unexpected process creation (e.g., shell spawns) by the web application service account.

Compensating Controls: Implement strict file type validation and extension filtering at the Web Application Firewall (WAF) level to block malicious PDF uploads.

Public Exploit Available: Unknown.

The severity of this remote code execution flaw requires immediate patching. Administrators should verify their current version of Agora Project and upgrade to 25.10 immediately to eliminate this critical attack vector.