The vulnerability CVE-2025-22654 in kodeshpa Simplified (<= 1.0.6) permits unrestricted uploading of files with dangerous types. This allows an attacker to upload malicious files that could be executed or processed by the system, leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 10.0, reflecting a network attack vector with no required privileges or user interaction and complete system impact. No official patch or fix information is available, and the product is not a cloud service.

Successful exploitation can lead to full system compromise, including complete loss of confidentiality, integrity, and availability of the affected system. Attackers can upload and potentially execute malicious files, which may result in unauthorized control or disruption of the application and underlying infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality, implement strict file type validation, and apply other compensating controls to prevent uploading of dangerous file types.