The vulnerability CVE-2024-49653 in james-eggers Portfolleo (<= 1.2) allows an attacker with low privileges to upload files without proper restrictions on file types. This unrestricted file upload can be exploited to place a web shell on the server, granting the attacker remote code execution capabilities. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker with limited privileges to upload and execute arbitrary code on the web server via a web shell. This can lead to full system compromise, including data theft, data modification, and denial of service. The vulnerability affects all versions of Portfolleo up to 1.2. There are no known active exploits in the wild at present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the upload functionality to trusted users only and monitor for suspicious file uploads. Consider implementing additional file upload validation and web application firewall (WAF) rules to block potentially malicious uploads.