This vulnerability affects the update function in src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of Dromara UJCMS up to version 10.1.3. It allows remote attackers to manipulate special elements in the template engine due to improper neutralization, potentially leading to security issues related to template injection or code execution. The CVSS 4.0 score is 5.1 (medium), reflecting network attack vector, low complexity, no user interaction, and partial impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation can lead to improper neutralization of special elements in the template engine, which may allow attackers to manipulate template processing remotely. This can impact the confidentiality, integrity, and availability of the affected system to a limited extent. The vulnerability requires high privileges to exploit but does not require user interaction.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates. In the meantime, restrict access to the vulnerable endpoint and apply any available compensating controls to limit exposure. Since exploit code is published, timely patching once available is recommended.