This vulnerability in INK Official allows an attacker with at least low privileges to upload files without proper restrictions on file type, enabling the upload of malicious web shells. Successful exploitation can result in full system compromise, including unauthorized code execution and control over the web server. The issue affects all versions up to and including 4.1.2. No vendor patch or mitigation guidance is currently available.

The vulnerability enables an attacker to upload and execute arbitrary code on the web server, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized access, data theft, service disruption, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity as temporary measures.