Critical · published November 18, 2025
🚨 An unauthenticated file upload vulnerability in Mozart FM Transmitter could allow attackers to plant a PHP webshell with just a crafted request — talk about an open door! 🔥 Think of this as a hotel with no front desk staff to check IDs or issue room keys. Anyone can walk in, drop their bags (or malicious files) in the upload directory, and take over the entire establishment! If exploited, a rogue attacker could upload a malicious file, gaining complete control of the server. This means they could execute any code they want, access sensitive data, and potentially compromise the entire system. It’s an absolute nightmare scenario for any organization!
Think of this as a hotel with no front desk staff to check IDs or issue room keys. Anyone can walk in, drop their bags (or malicious files) in the upload directory, and take over the entire establishment! This vulnerability allows unauthenticated users to upload arbitrary files through the /upload_file.php endpoint, enabling remote code execution because uploaded files are stored directly in the /upload/ directory without any validation.
If exploited, a rogue attacker could upload a malicious file, gaining complete control of the server. This means they could execute any code they want, access sensitive data, and potentially compromise the entire system. It’s an absolute nightmare scenario for any organization! To secure your system, update the Mozart FM Transmitter to the latest version immediately to patch this vulnerability. Additionally, implement file type validation and restrict uploads to known safe formats to prevent unauthorized file execution. Regularly audit your server for any suspicious files in the upload directory! You’ve got this! With these steps, you’ll have your system protected in no time. 🛡️