LiveBOS, an object-oriented business architecture middleware by Fujian Apex Software Co. Ltd., contains an arbitrary file upload vulnerability (CWE-434) combined with path traversal (CWE-22) in its UploadFile.do;.js.jsp endpoint. This vulnerability allows unauthenticated remote attackers to upload malicious files outside the intended directory structure by manipulating the filename parameter. Successful exploitation can lead to remote code execution on the server, resulting in full system compromise. The issue affects LiveBOS Server builds released before August 2024. While newer versions reportedly remediate this vulnerability, no specific patch or detailed vendor advisory is currently available. The vulnerability was publicly disclosed with a CVSS 4.0 score of 10.0, reflecting its critical impact. No known exploits in the wild have been confirmed to date.

An unauthenticated remote attacker can upload arbitrary files outside the intended directory structure on the LiveBOS Server, potentially leading to remote code execution and full system compromise. This poses a critical risk to the confidentiality, integrity, and availability of affected systems. The vulnerability affects all versions prior to August 2024 builds. No confirmed exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is reportedly remediated in newer versions of LiveBOS released after August 2024, so upgrading to the latest version once available is recommended. Until an official patch or advisory is released, restrict access to the UploadFile.do;.js.jsp endpoint and monitor for suspicious file uploads if possible.