GouGuOA EUVD-2026-109605

Exploitation requires a valid low-privilege authenticated session on the target GouGuOA instance (CVSS PR:L) and network reachability to the disk module's chunkUpload API endpoint (app/disk/controller/Api.php). The specific prerequisite is the ability to invoke chunked file upload and control the file_extension argument, which is used to bypass upload extension restrictions (CWE-434 unrestricted upload). Limiting factors: an attacker must already hold credentials/account access (no unauthenticated path per the vector), and full code-execution impact depends on the uploaded file being stored in a web-accessible, server-executable location - the available sources do not detail the exact storage path or execution mechanism beyond the file_extension manipulation. No user interaction is required (UI:N). Affected versions are GouGuOA through 6.1.2; no fixed version is given because the vendor did not respond.

Signals are mixed and point to a moderate, not emergency, priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 5.3) describes a remotely reachable but authenticated flaw (PR:L) with partial impact (VC:L/VI:L/VA:L) and exploit maturity E:P (proof-of-concept). The vuln.today decision label is 'this_month', consistent with a real but non-urgent issue. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. A public PoC reference exists but is not verified as working exploit code. Note a tension between the scoring and the referenced material: the input vector rates impact as only Low across confidentiality/integrity/availability, yet the linked GitHub report is titled a 'RCE' report and the weakness is CWE-434 unrestricted file upload, a class that commonly yields webshell-based remote code execution - if that holds, real-world technical impact would be higher than the 5.3 base score implies. Overall this is a genuine but authenticated, single-product vulnerability warranting scheduled patching rather than crisis response; the unresponsive vendor is a complicating factor for remediation.

An attacker with a valid low-privilege account on an internet-reachable GouGuOA instance calls the chunkUpload endpoint in the disk module and manipulates the file_extension argument to bypass extension filtering, uploading an attacker-controlled file. If the uploaded file is web-reachable and executable (as the linked report asserts), this yields code execution on the server. A public PoC reference exists but is not verified as working exploit code, and exploitation is remote over the network (AV:N) with low attack complexity (AC:L).