This vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform allows an attacker to perform unrestricted file uploads by manipulating the File argument in the /dm/dispatch/userinfo/upload endpoint. The flaw affects versions up to 20260617. The vulnerability is remotely exploitable without authentication or user interaction. Public exploit code exists, increasing the risk of exploitation. No official patch or remediation has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker to upload arbitrary files to the affected system, potentially leading to unauthorized code execution, data compromise, or system disruption. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, the CVSS score of 6.9 indicates a medium severity impact with limited scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing network-level restrictions to limit access to the vulnerable endpoint and monitor for suspicious upload activity as interim measures.