The vulnerability CVE-2024-52400 in Gallerio allows an attacker with low privileges to upload files without proper restrictions on file types. This can be exploited to upload a web shell, which may lead to complete compromise of the affected web server. The issue affects all versions up to and including 1.01. The CVSS 3.1 base score of 9.9 reflects network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the software is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server via a web shell, leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability requires only low privileges and no user interaction, making it highly exploitable in network environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting file upload functionality, implementing strict file type validation, and applying other compensating controls to prevent unauthorized file uploads. Monitor for suspicious activity related to file uploads and web shell presence.