The vulnerability CVE-2024-52369 in Optimal Access KBucket allows an attacker with low privileges to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting the attacker remote code execution capabilities on the web server. The issue affects all versions up to and including 4.2.2. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected web server, including unauthorized remote code execution, data theft, data modification, and service disruption. The attacker can upload malicious files such as web shells, which can be used to maintain persistent access and further escalate privileges or move laterally within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality, implement strict file type validation, and apply web application firewall (WAF) rules to detect and block malicious uploads. Monitor for suspicious activity related to file uploads and web shell indicators.