This vulnerability (CVE-2024-2890) in Tumult Hype Animations allows an attacker with high privileges to upload files of dangerous types without restriction. This can lead to severe impacts including full compromise of the affected system's confidentiality, integrity, and availability. The issue affects all versions up to 1.9.12. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed yet.

Successful exploitation could allow an attacker with high privileges to upload malicious files, potentially leading to full system compromise including data theft, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious activity related to file uploads. Avoid granting unnecessary high privileges to users who can upload files.