This vulnerability in Ruijie RG-UAC up to version 1.0-R1.8.2.p5 allows an attacker to perform unrestricted file uploads by manipulating the upload_image argument in the user_auth_commit.php script. The flaw enables remote attackers to upload arbitrary files without authentication or user interaction, potentially leading to further compromise. The CVSS 4.0 base score is 6.9, indicating medium severity. No official fix or vendor advisory is currently available, and the patch status remains unconfirmed.

Successful exploitation could allow an unauthenticated remote attacker to upload arbitrary files to the affected system. This could lead to unauthorized code execution or other malicious activities depending on the server configuration and the nature of the uploaded files. However, no confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected endpoint, implementing strict file upload validation, or applying other compensating controls to limit exposure.