The Official Document Management System developed by 2100 Technology contains an Arbitrary File Upload vulnerability (CWE-434) that permits authenticated remote attackers to upload files with dangerous types. This can enable attackers to deploy web shell backdoors, resulting in arbitrary code execution on the affected server. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation responsibility lies with the user.

Successful exploitation allows authenticated attackers to upload and execute arbitrary files, such as web shells, on the server hosting the Official Document Management System. This leads to arbitrary code execution, compromising the confidentiality, integrity, and availability of the system. The vulnerability poses a high risk to affected environments due to the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict file upload permissions to trusted users only and implement additional security controls such as file type validation and monitoring for suspicious files. Since the vendor has not provided an official fix or mitigation, users must remain vigilant and apply any future updates promptly.