HUBzero CMS through version 2.2.32 contains a path traversal vulnerability in its project file upload handlers. Authenticated project members can exploit this flaw by supplying traversal sequences in upload parameters, allowing them to write files to arbitrary locations outside the project repository. Because these files are written with web server privileges, this may enable attackers to execute arbitrary code on the server.

An attacker with authenticated project member privileges can write arbitrary files outside the intended directory, potentially leading to remote code execution with web server privileges. This elevates the risk of full system compromise or unauthorized control of the affected server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict project member privileges and monitor file upload activities closely to mitigate exploitation risk.