MCMS Arbitrary File Upload Vulnerability in Ueditor Component

A vulnerability allowing arbitrary file upload has been identified in the ueditor component of MCMS version 5.4.3. This issue enables attackers to upload crafted files that could execute arbitrary code, potentially leading to malicious effects on the user.

Impact

Exploitation of this vulnerability could result in unauthorized code execution on the server where MCMS is hosted.

Reproduction

The vulnerability can be reproduced by uploading a malicious file through the ueditor component while editing in the editor. This action bypasses file upload restrictions and allows the execution of arbitrary code.