Wubang Five-in-One CVE-2026-129262

Exploitation requires network reachability to the application's /ws.asmx web service endpoint and the ability to call its DiyFileUpload function, which performs an upload without restricting file type/content (CWE-434); per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against affected versions up to 3.5. Limiting factors: the endpoint must be internet- or network-exposed to the attacker; realistic impact (e.g. remote code execution via a planted webshell) depends on whether uploaded files are stored in a web-accessible, executable location, which the available sources do not confirm. No fixed version is identified and the vendor did not respond, so the only scoping limit is the product and version, not a configuration toggle.

Signals are moderate and partially conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated, no-interaction flaw - the easy-access profile that normally drives urgency - yet the same vector scores impact as only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a mid-range 6.9. That impact rating is notably conservative for a CWE-434 unrestricted file upload, which frequently enables webshell deployment and full compromise; the available evidence does not confirm code execution, so the true impact may be understated - verify against the product's handling of uploaded files. There is no CISA KEV listing and no EPSS value in the input, so widespread active exploitation is not evidenced. The exploitation status is 'E:P' (proof-of-concept) and the referenced PoC is a GitHub issue that is not verified as working exploit code, so this is a credible but unproven exploitation risk rather than confirmed in-the-wild attacks. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority. Net: a genuinely remote unauthenticated upload flaw in a niche product - worth patching on a normal cycle, but the obscure footprint and unverified exploit lower real-world urgency relative to the alarming attack-vector metrics.

A remote attacker with no credentials reaches the exposed /ws.asmx web service and invokes the DiyFileUpload function to upload an arbitrary file to the server, bypassing file-type restrictions. Depending on where the file lands and whether it is executable, this could plant a webshell and lead to server compromise. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code.