The vulnerability exists in the FileController::upload function of hcr707305003 shiroiAdmin versions 1.1 and 1.3. An attacker can remotely exploit this by manipulating the File argument to upload arbitrary files without restriction. This could lead to unauthorized file uploads on the server. The issue is fixed in version 1.4, with the patch identified by commit 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70. The vendor did not provide a response to early disclosure attempts. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, potentially leading to unauthorized file storage or execution on the affected system. This can compromise system integrity and confidentiality depending on the uploaded content and server configuration. The CVSS score of 6.9 reflects a medium severity impact with low impact on confidentiality, integrity, and availability but easy network exploitation without privileges or user interaction.

Upgrade affected installations of hcr707305003 shiroiAdmin from versions 1.1 or 1.3 to version 1.4, which contains the official fix for this unrestricted upload vulnerability. Since the vendor did not respond to disclosure, upgrading is the primary recommended mitigation. Patch status is confirmed by the availability of version 1.4 containing the fix identified by commit 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70.