CVE-2026-86272: Unrestricted Upload in Beijing Meite Software Technology U+Smart Enjoyment WebSite

The vulnerability CVE-2026-86272 affects Beijing Meite Software Technology's U+Smart Enjoyment WebSite version 18.6001.1096.1000. It is caused by insufficient validation of the 'File' argument in the /Report/Upload/UploadFormImg.ashx endpoint, allowing unrestricted file uploads. This flaw can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, and no privileges required. The vulnerability was publicly disclosed but no official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability allows an attacker to upload arbitrary files to the affected system remotely. This could lead to unauthorized file storage, potential execution of malicious code, or further system compromise depending on the server configuration and file handling. The CVSS score of 6.9 reflects a medium impact with limited scope and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload endpoint, implement strict file type and size validation, and monitor for suspicious upload activity. Avoid exposing the vulnerable endpoint to untrusted networks if possible.