CVE-2021-46386

mingSoft MCMS lets a remote attacker upload a crafted jspx web shell to the FileAction#upload handler and thereby execute arbitrary code on the server. This is an unauthenticated file-upload-to-RCE in a content management system: the upload path doesn't stop an executable JSPX file from landing where the server will run it, so a single crafted request converts into a web shell and full control of the CMS host.

Unauthenticated RCE in an installable CMS is prime botnet fodder. There's no credential to obtain and no user to phish, so once the vulnerable path is public, automated scanners tend to hit every reachable MCMS install looking for the FileAction upload endpoint. The result of a successful drop is the standard web-shell playbook — defacement, SEO spam, cryptomining, data theft, or a pivot into the hosting network — and the version boundary, through 5.2.5, is all that separates an exposed site from compromise.

As with any self-hosted CMS, our real problem is discovery, not comprehension. MCMS installs tend to be stood up per-project and rarely tracked centrally, so the work is enumerating which instances we (or teams we support) actually run, at what version, and which expose the upload path to the internet. That reachable-and-vulnerable intersection is the urgent set; where patching to a fixed release lags, blocking or authenticating the FileAction upload endpoint at the proxy is the stopgap, and any exposed pre-5.2.5 install is treated as suspect until proven clean.