Unrestricted File Upload Vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform

CVE-2026-18969 is a high-severity security vulnerability affecting the Rongzhitong Visual Integrated Command and Dispatch Platform versions up to 20260617. The flaw resides in the handling of the 'File' argument within the /dm/dispatch/userinfo/upload function. Due to improper access control and insufficient validation of uploaded files, an unauthenticated remote attacker can upload arbitrary files to the server. This vulnerability allows for the potential execution of malicious code, leading to system compromise. Publicly available exploit material for this vulnerability is documented, and the vendor has not provided a response or a patch as of the time of disclosure.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to gain unauthorized access to the affected command and dispatch platform. By uploading malicious files (such as web shells), attackers can achieve remote code execution, potentially resulting in full system takeover, exfiltration of sensitive command data, and disruption of critical dispatch services. Given the nature of command and dispatch systems, the potential for operational impact is significant.

Recommendation

Detection engineering teams should focus on identifying unauthorized attempts to interact with the identified upload endpoint.

• Deploy the provided Sigma rule to monitor for suspicious POST requests to the vulnerable upload URI.
• Inspect web server access logs for requests to /dm/dispatch/userinfo/upload that do not originate from authorized administrative workflows or that exhibit unusual user-agent strings.
• Restrict network access to the management and dispatch platform interfaces to only trusted IP ranges via internal firewalls or VPNs to mitigate remote exploitation risks.