The vulnerability CVE-2025-23918 affects Smallerik File Browser versions up to 1.1 and allows an attacker with low privileges to upload files of dangerous types without restriction. This can include web shells, which may be executed on the web server, leading to complete compromise of the system. The vulnerability is remotely exploitable over the network without user interaction and requires low attack complexity. It impacts confidentiality, integrity, and availability at a high level.

Successful exploitation can result in an attacker uploading and executing arbitrary code on the web server, leading to full system compromise including data theft, modification, or destruction, and denial of service. The vulnerability affects all installations of Smallerik File Browser up to version 1.1. There are no known exploits in the wild reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the file upload functionality to trusted users only and consider disabling file uploads if possible. Monitor for suspicious activity related to file uploads. Avoid exposing the Smallerik File Browser to untrusted networks.