The vulnerability CVE-2024-49314 in JiangQie Free Mini Program allows attackers to upload files of dangerous types without restriction, including web shells, to the web server. This can lead to complete compromise of the affected system. It affects versions up to and including 2.5.2. The CVSS v3.1 score is 10.0 (critical), with attack vector network, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available. The product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the server hosting the JiangQie Free Mini Program. This can result in full system compromise, including complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 10, indicating severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict file upload functionality, implement strict file type validation, and monitor for suspicious upload activity. Consider disabling or restricting the vulnerable upload feature if possible.