The vulnerability CVE-2024-52380 affects Picsmize versions up to 1.0.0 by allowing unrestricted upload of files with dangerous types, such as web shells. This can lead to remote code execution on the affected server. The CVSS 3.1 base score is 10.0, reflecting an attacker can exploit this remotely without authentication or user interaction, causing complete compromise of confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an unauthenticated attacker to upload malicious files (e.g., web shells) to the server running Picsmize, resulting in full system compromise including remote code execution, data theft, data modification, and denial of service. The vulnerability is critical with a CVSS score of 10.0, indicating maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling file upload functionality or restricting allowed file types through web server or application-level controls. Monitoring for suspicious file uploads and isolating affected systems may reduce risk. No vendor advisory or patch links are currently provided, so follow vendor channels for updates.