This vulnerability, classified as CWE-434, affects Tribulant Newsletters up to version 4.9.5 and allows users with high privileges to upload files of dangerous types without restriction. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The lack of a vendor advisory or patch means remediation status is currently unknown.

Successful exploitation can lead to full system compromise including loss of confidentiality, integrity, and availability of the affected system. Since the vulnerability requires high privileges, the threat is limited to users who already have elevated access. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to trusted personnel only and monitor for suspicious file uploads. Avoid deploying the affected versions in production environments if possible.