This vulnerability in mjperpinosa stumasy allows remote attackers to perform unrestricted file uploads by manipulating the up_file_to_post argument in the add_post.php script. The flaw resides in an unknown function within the specified file path. The product's rolling release model complicates identification of affected or fixed versions. The vulnerability has been publicly disclosed, but the vendor has not yet issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to upload arbitrary files to the server remotely, potentially leading to unauthorized file storage or execution depending on server configuration. The CVSS score of 5.3 reflects a medium impact with low confidentiality, integrity, and availability impacts. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, consider implementing manual controls such as restricting file upload types, validating and sanitizing inputs, and applying web application firewall rules to detect and block suspicious upload attempts.