The vulnerability CVE-2024-27964 in Gesundheit Bewegt GmbH's Zippy product (up to version 1.6.9) is an unrestricted file upload issue (CWE-434). It permits an attacker with network access and low privileges to upload files of dangerous types without restriction, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS v3.1 score is 8.8, reflecting the ease of exploitation and severe consequences. No official patch or remediation level has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

Successful exploitation could allow attackers to upload malicious files, potentially resulting in arbitrary code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability with high severity. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting file upload permissions, implementing file type validation, and monitoring for suspicious uploads as interim mitigations.