Acrel Environmental Monitoring Cloud Platform Unrestricted File Upload Vulnerability

A vulnerability allowing unrestricted file uploads has been identified in the Acrel Environmental Monitoring Cloud Platform, in versions prior to 20250804. The issue arises in the '/NewsManage/UploadNewsImg' file, where the 'File' argument can be manipulated to bypass upload restrictions. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which could be used to upload malicious files that are executed or processed by the application, potentially leading to further attacks or system compromise.