Stacks Mobile App Builder versions up to 5.2.3 suffer from an unrestricted file upload vulnerability that permits attackers to upload malicious files such as web shells to the server. This vulnerability allows remote attackers to execute arbitrary code on the affected system without any authentication or user interaction, leading to full system compromise. The CVSS 3.1 base score is 10.0, reflecting the critical nature of this issue with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to upload and execute arbitrary code on the web server, resulting in full system compromise including complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality, implement strict file type validation, and monitor for suspicious uploads as temporary mitigations.