Sunnet CTMS and CPAS contain an arbitrary file upload vulnerability (CWE-434) that permits privileged remote attackers to upload and execute malicious files, such as web shells, on the server. This can result in arbitrary code execution, compromising the affected system. The vulnerability has a CVSS 4.0 score of 8.6, reflecting high impact and exploitability with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects version 0 (likely initial or unspecified versions) of the product. No patch or official remediation level has been published by the vendor as of the current data.

Successful exploitation allows privileged remote attackers to upload and execute arbitrary files, including web shell backdoors, leading to arbitrary code execution on the server. This can compromise the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged user access to the upload functionality and monitor for suspicious file uploads. Avoid exposing the upload interface to untrusted networks. Follow vendor updates closely for any forthcoming patches or mitigations.