This vulnerability (CVE-2024-35767) in Bogdan Bendziukov Squeeze allows attackers with high privileges to upload files of dangerous types without restriction, enabling code injection. The issue affects all versions up to 1.4. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. No official fix or patch has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to inject and execute arbitrary code on the affected system, leading to complete compromise of confidentiality, integrity, and availability of the system running Squeeze. This could result in unauthorized access, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the affected application to untrusted networks where possible.