An unauthenticated remote code execution vulnerability in T-Systems International GmbH ImageMaster allows attackers to achieve full system compromise via malicious file uploads.

The application fails to properly validate files uploaded through the add attachments function within the create new document module. This allows an unauthenticated remote attacker to upload and execute arbitrary code on the underlying server.

The ability to execute arbitrary code without authentication presents an extreme risk to the confidentiality, integrity, and availability of the host system. With a CVSS score of 9.8, this vulnerability allows for complete system takeover, which could facilitate data theft, lateral movement within the network, or the deployment of ransomware.

Immediate Action: Contact T-Systems International GmbH support to obtain the necessary patch or security update for version 9.14.2.8.1, as a public fix is not currently documented.

Proactive Monitoring: Inspect web server logs for suspicious file upload requests or attempts to access non-standard file extensions in the document storage directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable content or unauthorized file types.

Public Exploit Available: Unknown

This vulnerability is critical and requires immediate attention to prevent unauthorized remote code execution. If a patch is not immediately available, restrict access to the affected document creation functionality to trusted networks or internal users only until a vendor-supplied update can be implemented.