The Novel Design Store Directory versions up to 4.3.0 contain an unrestricted file upload vulnerability that permits attackers to upload malicious files such as web shells. This allows remote code execution on the affected web server without authentication or user interaction. The vulnerability is critical with a CVSS 3.1 base score of 10. No official patch or fix has been disclosed yet, and the product is not a cloud service, so remediation depends on vendor updates or manual mitigation.

Successful exploitation results in an attacker uploading a web shell, leading to full compromise of the web server. This includes complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without any privileges or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions, implement strict server-side validation of uploaded files, and consider disabling file uploads if not required. Monitor for suspicious activity related to file uploads. Do not rely on generic mitigations unless specifically applicable to this vulnerability.