CVE-2026-10071 is an arbitrary file upload vulnerability in Interinfo's DreamMaker product. It permits unauthenticated remote attackers to upload files of dangerous types, including web shells, which can be executed on the server to achieve arbitrary code execution. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No affected versions or patch information are provided, and the vendor has not released an official fix or mitigation guidance.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary code on the affected server, potentially leading to full system compromise. This can result in unauthorized access, data theft, service disruption, or further attacks originating from the compromised server. The vulnerability is critical due to the lack of authentication and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the DreamMaker application, implement network-level controls to limit exposure, and monitor for suspicious file uploads or web shell activity. Avoid deploying the product in publicly accessible environments without additional protective measures.