This vulnerability in mjperpinosa stumasy allows remote attackers to perform unrestricted file uploads by manipulating the up_file_to_post argument in the add_post.php script. The lack of restrictions on uploaded files could lead to unauthorized file placement on the server. The product uses a rolling release update model, and no specific affected versions or patches have been identified. The vendor has not issued a response or remediation guidance as of the publication date. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload arbitrary files to the server, potentially leading to unauthorized code execution or other malicious activities depending on the server configuration and file handling. The impact is rated medium based on the CVSS score, reflecting limited but notable risk due to the unrestricted upload capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. In the meantime, restricting file upload permissions, validating and sanitizing uploaded files, and implementing web application firewalls could help mitigate exploitation risk.