CVE-2026-10072 is an Arbitrary File Upload vulnerability in Interinfo's DreamMaker product. It permits attackers with privileged remote access to upload files of dangerous types without restriction, enabling them to deploy web shell backdoors and execute arbitrary code on the server. The vulnerability is classified under CWE-434 and carries a high CVSS 4.0 base score of 8.6, indicating significant impact potential. No vendor-provided patch or remediation level is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or user mitigations.

Successful exploitation allows privileged remote attackers to upload and execute malicious files on the server, resulting in arbitrary code execution. This can lead to full compromise of the affected system. There are no known exploits in the wild at present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged remote access to the DreamMaker application and monitor for suspicious file uploads. Avoid exposing the application to untrusted networks and consider additional file upload validation or filtering controls if possible.