This vulnerability affects an unspecified function in the Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617. The flaw resides in the /dm/dispatch/userinfo/upload endpoint, where manipulation of the File argument leads to unrestricted file upload. This allows an attacker to upload arbitrary files remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code exists, but there is no known active exploitation in the wild. The vendor has not provided any response or patch information.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system without authentication or restrictions. This could lead to unauthorized file placement, potentially enabling further attacks such as remote code execution or system compromise depending on the uploaded file and environment. The exact impact depends on how the uploaded files are handled by the platform.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded and no fix is published, users should apply compensating controls such as restricting access to the upload endpoint, monitoring for suspicious uploads, and isolating the affected system where possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.