The vulnerability CVE-2024-52377 affects bdthemes Instant Image Generator versions up to 1.5.2 and allows unauthenticated attackers to upload files of dangerous types without restriction. This can include web shells, which may be used to execute arbitrary code on the affected server. The vulnerability is remotely exploitable over the network without any privileges or user interaction, and it affects the confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 10.0, reflecting the critical severity of this issue.

Successful exploitation of this vulnerability can lead to complete compromise of the affected web server, including unauthorized code execution, data theft, and service disruption. The attacker can upload a web shell, gaining persistent remote access and control over the system. This poses a critical risk to the confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity. Avoid exposing the affected application to untrusted networks if possible. Follow bdthemes' official channels for updates and patches.