This vulnerability in Renata Bracichowicz 3D Work In Progress allows an attacker with at least low privileges to upload files without proper restrictions on file types. This can enable uploading a web shell, which could be used to execute arbitrary code on the server, leading to full system compromise. The affected versions include all versions up to and including 1.0.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no user interaction, and scope change with high impact on confidentiality, integrity, and availability.

Successful exploitation can result in an attacker uploading a web shell to the server, potentially leading to full system compromise including unauthorized access, data theft, data modification, and denial of service. The vulnerability affects all installations of 3D Work In Progress up to version 1.0.3. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious file uploads as interim mitigations. Avoid exposing the upload functionality to untrusted users if possible.