A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file business/business-system/src/main/java/com/glowxq/system/admin/controller/SysFileController.java. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
In plain language
Written by AI from the record
CVE-2026-4201 is an unrestricted file upload flaw in glowxq-oj that lets anyone send files to the app without login or file checks; if your business runs glowxq-oj and it’s reachable from the internet, you should act urgently.
In glowxq-oj, CVE-2026-4201 is an unauthenticated unrestricted file upload (CWE-284/CWE-434) where the SysFileController upload endpoint accepts arbitrary files over the network without verifying the requester or the file type.
If you're affected
Malicious files uploaded
Site compromise risk
Customer data exposure
Service disruption
What is it
This issue means the application has an “upload files” feature but it doesn’t properly check who is uploading or what they’re uploading. Think of it like leaving an upload door open to anyone, without checking the contents. An attacker could use that to place harmful files on your server, which can lead to broader compromise or outages.
Who is affected
This matters if your business uses or hosts glowxq-oj and anyone on the internet can reach the upload feature. The finding says the upload can be done without requiring login or user interaction, so it’s more exposed than a typical “only logged-in users can upload” bug. It’s a risk when the application (or upload endpoint) is reachable from the network in a way an attacker can contact it.
How urgent is it
This is RED because the flaw is openly reachable over the network and does not require login, which lowers the barrier for abuse. While KEV listings and clear dated incident reports aren’t available here, the weakness is in a core upload function and the available information indicates the impact could be serious. If glowxq-oj is internet-reachable, treat this as a priority fix now.
What to do — in detail
Confirm exposure
Verify whether glowxq-oj is deployed and exposed to the internet (web/proxy/firewall rules). The finding indicates remote network access is possible.
Determine the exact glowxq-oj version/build you run. The disclosure states: “up to 6f7c723090472057252040fd2bbbdaa1b5ed2393” is affected.
Decide if you are affected
If your instance is at or before 6f7c723090472057252040fd2bbbdaa1b5ed2393, you should assume you’re affected because no unaffected release information is available (the product “does not use versioning”).
Remediate (patch status and upgrade path)
No fix/patch information is available in the provided findings, so you cannot reliably upgrade “to a known safe version” based on this dataset.
Immediate priority is to reduce exposure while you seek an official fixed build from the vendor/maintainer.
Compensating controls (if patching is delayed)
Restrict access: block public internet access to glowxq-oj’s web interface or, at minimum, block direct access to the upload endpoint.
Restrict who can upload: if your deployment supports it, require authentication/authorization for file uploads and limit permissions to trusted admins only.
Enforce upload constraints: configure (or implement, if configurable) strict server-side checks—only allow expected file types, enforce maximum file size, and reject unexpected content.
Monitor: watch for repeated upload attempts, unusual file names/types, and spikes in upload-related requests.
What to monitor after changes
Upload request logs for failed and successful uploads.
Any unexpected changes to application files/directories (especially those related to uploads).
Alerts from your WAF/firewall if you deploy upload-specific blocking rules.
KEV / deadlines
No KEV entry was provided for CVE-2026-4201 in the available findings, so there is no CISA due date stated here.
Technical context
Severity and nature
Weakness types: CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Mechanism: unauthenticated upload endpoint in SysFileController.java accepts arbitrary files without verifying requester identity and without checking file type.
Attack vector and reachability
Remote over the network (attack vector: Network).
Authentication required: None; user interaction: None.
Reachability in default config: unknown (so exposure depends on whether your deployment is internet-reachable).
Exploitation status
KEV: not listed.
Public exploit code: none reported in the findings.
Press/real-world incidents: no clear dated claims; incidents: none reported.
Fix availability
No patch/fix information is available in the provided findings; the disclosure notes the application “does not use versioning,” which prevents clear identification of fixed/unfixed releases from version numbers.
Likelihood signals
EPSS prediction is provided (but should not be used as the deciding factor here), and KEV/news confirmation is not present in the provided findings.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
