CVE-2026-18969 is a vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, where an attacker can remotely manipulate the File argument in the /dm/dispatch/userinfo/upload endpoint to achieve unrestricted file upload. This could lead to unauthorized information disclosure, integrity compromise, and availability impact. The vulnerability requires no privileges and no user interaction, and can be exploited over the network. The vendor has not provided a response or patch, and the exploit is publicly available.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, potentially leading to information disclosure, integrity violations, and denial of service. The CVSS score of 7.3 reflects a moderate risk with network attack vector, no required privileges, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level controls to restrict access to the vulnerable endpoint and monitor for suspicious upload activity until an official fix is released.