An unrestricted file upload flaw in funadmin up to version 7.1.0-rc6 allows remote unauthenticated attackers to execute arbitrary operations and compromise the integrity of the host system.

This is an unrestricted file upload vulnerability categorized under CWE-434, involving the chunkUpload function within app/common/service/UploadService.php and requiring no authentication from a remote attacker.

A successful exploit could allow malicious actors to upload arbitrary web shells or executable files, potentially leading to complete remote code execution, system takeover, or severe data compromise. Given the CVSS score of 7.3, this high severity vulnerability poses a substantial operational risk by exposing core infrastructure to unauthorized manipulation.

Immediate Action: Deploy patch 59 or update funadmin beyond version 7.1.0-rc6 as recommended by the vendor.

Proactive Monitoring: Monitor access logs and file upload directories for unexpected script execution attempts or unusual file types.

Compensating Controls: Implement Web Application Firewall rules to block unauthorized upload requests targeting the chunked upload endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the referenced issue tracker on Gitee.

System administrators must treat this high severity flaw with extreme urgency due to the availability of public proof-of-concept details and the unauthenticated remote attack vector. Apply patch 59 immediately and review upload directories to ensure no unauthorized files have been introduced into the environment.