This vulnerability affects the member::setAvatar function in the /index.php?m=member&f=user&v=setAvatar endpoint of WuzhiCMS up to version 4.1.0. The issue arises from improper handling of the File argument, allowing unrestricted file uploads. The vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. The project was notified early but has not issued a fix or advisory. Public exploit code is available, increasing risk of exploitation.

Successful exploitation allows remote attackers with low privileges to upload arbitrary files to the server, potentially leading to unauthorized file storage and further attacks depending on server configuration. The impact on confidentiality, integrity, and availability is limited but could be escalated if combined with other vulnerabilities or misconfigurations.

No official fix or patch is currently available from the vendor. Users should monitor vendor channels for updates. As a temporary measure, restrict file upload permissions, implement server-side validation, and consider disabling the avatar upload feature if feasible until a patch is released.