This vulnerability in Harsh iSpring Embedder (<= 1.0) enables an unauthenticated attacker to perform Cross-Site Request Forgery (CSRF) attacks that result in uploading a web shell to the web server hosting the product. The vulnerability allows remote attackers to execute arbitrary code with the privileges of the web server. The CVSS 3.1 base score is 10.0, reflecting critical impact and ease of exploitation. No official patch or fix has been referenced in the available data.

Successful exploitation allows an attacker to upload a web shell, leading to full compromise of the affected web server. This includes complete loss of confidentiality, integrity, and availability of the system. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing CSRF protections such as verifying origin headers, using anti-CSRF tokens, or restricting access to the iSpring Embedder interface. Monitor for suspicious activity related to file uploads. Do not assume the vulnerability is mitigated without vendor confirmation.