An unauthenticated remote code execution risk exists in the glowxq-oj platform due to an unrestricted file upload vulnerability.

This flaw exists in the Upload function within the SysFileController.java file, which fails to properly validate file types or access controls, allowing unauthenticated attackers to upload arbitrary files to the server.

The ability for an unauthenticated user to upload files to the server presents a critical risk of full system compromise. If an attacker successfully uploads a malicious script, they may achieve remote code execution, leading to data exfiltration, system defacement, or persistent access. With a CVSS score of 7.3, the vulnerability is classified as High, reflecting the significant potential for operational disruption and loss of confidentiality.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected upload endpoint at the network or application level or disable the file upload feature entirely until the vendor provides a secure update.

Proactive Monitoring: Monitor server access logs for unusual POST requests to the SysFileController endpoint and audit the directory where user-uploaded files are stored for unauthorized or suspicious script files.

Compensating Controls: Deploy a Web Application Firewall with strict rules to inspect and filter incoming file uploads, blocking any non-conforming or executable file types from reaching the backend server.

Public Exploit Available: Yes — a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the nature of the flaw, this vulnerability should be treated with high urgency. Organizations utilizing the glowxq-oj platform must immediately implement network-level access controls to isolate the vulnerable controller and perform an audit of their environment to identify any signs of unauthorized file uploads.