This vulnerability in lenve vhr 1.0-SNAPSHOT involves the FastDFSUtils.upload function within the Avatar Upload component, specifically in the /hr/userface file. An attacker can remotely manipulate the File argument to upload files without restriction, potentially leading to unauthorized file uploads. The vulnerability has been publicly disclosed with an available exploit. The vendor was contacted but did not provide any response or patch information.

The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file storage on the server. This may facilitate further attacks such as code execution or data compromise depending on the server configuration and file handling. However, no confirmed in-the-wild exploitation has been reported.

No official patch or remediation is currently available as the vendor has not responded to disclosure. Users should consider restricting access to the affected upload functionality, implementing additional validation or filtering on uploaded files, or disabling the Avatar Upload feature until a fix is provided. Monitor vendor channels for updates.