An unauthenticated remote code execution vulnerability exists in the light0011 cms due to an unrestricted file upload flaw, posing a critical risk to server integrity.

The application fails to validate file extensions, MIME types, or sizes within the ThinkPHP Upload class, specifically triggered via the unauthenticated Home/User/upload endpoint. This lack of access control and validation allows an unauthenticated attacker to upload malicious files to the server.

Successful exploitation permits an attacker to upload arbitrary files, which frequently results in remote code execution on standard PHP hosting configurations. This compromise grants the attacker full control over the web application, leading to potential data exfiltration, lateral movement within the network, and complete service disruption. Given the CVSS score of 7.3 and the ability for unauthenticated remote access, this vulnerability represents a significant threat to the availability and confidentiality of the business environment.

Immediate Action: As no official patch is currently available, immediately restrict access to the upload endpoints via web server configuration or by implementing mandatory authentication checks within the affected controller files.

Proactive Monitoring: Review web server access logs for suspicious POST requests directed at the Home/User/upload, Admin/ChapterController, and Admin/AdController endpoints. Monitor for the creation of unexpected files within the upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious file extensions or non-standard MIME types. Ensure the web server configuration is set to prevent the execution of scripts within the upload directory.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue report referenced by the project.

Due to the lack of a vendor-supplied patch and the presence of a functional proof-of-concept, users must treat this vulnerability with high urgency. Organizations should prioritize isolating the affected CMS instances or disabling the vulnerable upload functionality until a formal security update is released and verified.