The vulnerability CVE-2024-52397 in Convert Docx2post allows an attacker with high privileges to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the web server. The CVSS score of 9.1 reflects the critical nature of this vulnerability, with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected product versions include all versions up to 1.4. No patch or vendor advisory information is currently available.

Successful exploitation can lead to remote code execution via web shell upload, resulting in full compromise of the affected web server. This includes complete loss of confidentiality, integrity, and availability of the system hosting Convert Docx2post. The vulnerability requires high privileges to exploit but does not require user interaction and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions to trusted users only and consider implementing file upload validation and filtering controls to prevent dangerous file types. Monitor for unauthorized file uploads and web shell indicators. Avoid exposing the upload functionality to untrusted networks or users.