This vulnerability (CWE-434) in canvasio3D Light allows unrestricted uploading of files with dangerous types, which can lead to critical impacts including full compromise of the affected system. It affects versions up to 2.5.0. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

Successful exploitation could allow an attacker to upload malicious files that may lead to remote code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level. There are no known active exploits reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and monitor for suspicious upload activity where possible. Avoid exposing the vulnerable application to untrusted networks or users.