Windu CMS version 4.1 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in its file uploading functionality. An attacker can craft a malicious website that, when visited by a victim, causes the victim's browser to upload a malicious file to the Windu CMS server without their consent. The vendor has not provided details about the vulnerability or affected version ranges beyond confirming version 4.1 as vulnerable.