Unrestricted File Upload Vulnerability in U+Smart Enjoyment WebSite

Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000 is susceptible to an unrestricted file upload vulnerability (CVE-2026-86272). The flaw exists within the /Report/Upload/UploadFormImg.ashx file, which improperly validates the File argument provided during the upload process. An attacker can leverage this vulnerability to upload malicious files, such as web shells, to the server. Since the exploit for this vulnerability has been publicly disclosed and is considered remotely exploitable without authentication, the risk of exploitation by threat actors is elevated. Successful exploitation allows for complete system compromise, including the execution of arbitrary commands in the context of the web application server.

Impact

Successful exploitation of CVE-2026-86272 allows an attacker to achieve remote code execution on the affected host. This can lead to full system compromise, data exfiltration, lateral movement, or the deployment of ransomware. Given the public availability of the exploit, organizations running the affected version are at high risk of targeted or opportunistic attacks.

Recommendation

• Restrict access to the /Report/Upload/UploadFormImg.ashx endpoint at the web application firewall or network perimeter.
• Implement strict file type validation and rename uploaded files to non-executable extensions.
• Monitor web server access logs for anomalous POST requests to the specified upload path.
• Check for and apply security updates provided by Beijing Meite Software Technology for U+Smart Enjoyment WebSite.