CVE-2026-102454 is an arbitrary file upload vulnerability in DigiWin EasyFlow .NET. Privileged remote attackers can exploit this flaw to upload files with dangerous types, such as web shells, enabling them to execute arbitrary code on the affected server. The vulnerability affects EasyFlow .NET versions >=6.6 <=6.6.19 and >=8.1 <=8.1.5. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond high privilege, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows privileged remote attackers to upload and execute web shell backdoors, resulting in arbitrary code execution on the server. This can lead to full compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected versions and monitor for suspicious file uploads or activity related to web shells.