This vulnerability in light0011 CMS involves the Upload::upload function of the ThinkPHP framework component, which fails to properly restrict file uploads. This flaw enables remote attackers to upload arbitrary files without restrictions. The product's rolling release model prevents precise version identification for affected or fixed releases. The vendor has not yet issued a fix or official response despite early notification. Public exploit code has been released, indicating potential for active exploitation.

Successful exploitation allows remote attackers to upload arbitrary files to the server, potentially leading to unauthorized code execution, defacement, or further compromise of the affected system. The availability of public exploit code increases the likelihood of attacks. However, no confirmed active exploitation in the wild has been reported so far.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation guidance exists, users should consider implementing temporary mitigations such as restricting upload permissions, validating and sanitizing uploaded files, or disabling file uploads if feasible. Monitor vendor channels for future updates and patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.