This vulnerability (CVE-2026-37430) involves an arbitrary file upload issue in the ShopOrderImportController.java component of the qihang-wms software. An attacker can exploit this flaw by uploading a specially crafted file, which may result in arbitrary code execution on the affected system. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published, and no affected versions are specified.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code on the vulnerable system by uploading malicious files. This can compromise confidentiality, integrity, and availability of the system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality where possible and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable component to untrusted networks.