Hehanzzz

**Name of the Vulnerable Software and Affected Versions** JIZHICMS version 2.5 **Description** The issue allows a remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the `download url` parameter in the `app/admin/exts/` directory. This enables the attacker to potentially gain control over the system. **Recommendations** For JIZHICMS version 2.5, as a temporary workaround, consider disabling the file upload functionality in the `app/admin/exts/` directory until a patch is available. Restrict access to the `download url` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.