This vulnerability in EyouCMS (up to version 1.7.1) allows an attacker to perform an unrestricted file upload via the edit_adminlogo function by manipulating the filename parameter. This flaw exists in the application/admin/controller/Index.php file and can be exploited remotely without user interaction. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no privileges required for the attack. The vendor has not provided a fix or advisory, and no patch links are available. The exploit is public, increasing the risk of potential attacks.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to further compromise depending on the file type and server configuration. However, the CVSS vector indicates low impact on confidentiality, integrity, and availability, suggesting limited direct damage. Since the vulnerability requires no user interaction and can be triggered remotely, it poses a moderate risk to affected systems. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider temporary mitigations such as restricting access to the vulnerable function, implementing web application firewalls to detect and block suspicious upload attempts, or disabling the affected feature if feasible until a patch is released.