This vulnerability affects Dcat-Admin up to version 2.2.3-beta in the editorMDUpload function of the User Setting Page component. An attacker can remotely manipulate the editormd-image-file parameter in the /admin/dcat-api/editor-md/upload endpoint to perform unrestricted file uploads. This could potentially allow an attacker to upload malicious files to the server. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file placement on the server. The exact impact depends on the server configuration and how uploaded files are handled, but it could facilitate further attacks such as remote code execution or defacement. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable upload endpoint and monitor for suspicious upload activity. Consider implementing additional file upload validation and filtering as a temporary mitigation.