This vulnerability in zsadmin2025 ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead involves an unrestricted file upload issue in the /api/system/file/upload endpoint of the com.zs.file.controller.SysFileController component. An attacker can remotely manipulate the File argument to upload arbitrary files without restriction. The product's rolling release model means no discrete version numbers are available to identify affected or patched releases. The vendor has not provided a response or patch. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, increasing exploitation risk.

Successful exploitation allows remote attackers with low privileges to upload arbitrary files to the server, potentially leading to unauthorized file storage or execution. The impact on confidentiality, integrity, and availability is rated as low to limited. The presence of public exploit code increases the likelihood of attacks. However, no confirmed exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, organizations should monitor for updates from the vendor. Until a patch is available, consider restricting access to the vulnerable upload endpoint, implementing strict input validation, and applying other compensating controls to limit exposure.