The a+HCM product by aEnrich contains a CWE-434 unrestricted file upload vulnerability that permits unauthenticated attackers to upload arbitrary files to any location on the server. This includes potentially dangerous file types such as HTML documents, which could be used to trigger XSS-like impacts. The vulnerability is remotely exploitable without privileges or user interaction and has a medium severity rating based on CVSS 4.0 scoring. No patch or official remediation has been disclosed, and the product is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to upload arbitrary files to any path on the affected system. This can lead to the execution of malicious content, including HTML files that may cause XSS-like effects. The impact is considered medium severity due to the potential for unauthorized file placement and subsequent client-side attacks. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality where possible and monitor for suspicious file uploads. Avoid exposing the vulnerable upload interface to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.