This vulnerability affects saithink SaiAdmin up to version 5.0.1. The issue is located in the shell_exec function within the /app/saipackage/install/upload file of the Plugin Upload Endpoint component. It allows an attacker with high privileges to perform unrestricted file uploads remotely. The vulnerability has been publicly disclosed, indicating potential risk of exploitation, although no known exploits in the wild have been reported. No official patch or remediation level has been provided by the vendor or advisory sources.

The vulnerability enables remote attackers with high privileges to upload arbitrary files to the affected system, potentially leading to unauthorized code execution or system compromise. The CVSS 4.0 base score is 5.1, reflecting a medium severity impact with network attack vector, low complexity, and no user interaction required. The vulnerability has not been reported as exploited in the wild yet.

No official patch or remediation guidance is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restrict access to the affected upload endpoint to trusted users only and consider additional application-level controls to limit file uploads.