This vulnerability in Scriptonite user files allows unauthenticated attackers to upload files of dangerous types without restriction. Specifically, it enables uploading a web shell, which can be used to execute arbitrary code on the web server. The affected versions are up to and including 2.4.2. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell, leading to full compromise of the web server. This includes unauthorized access, data theft, data modification, and potential disruption of service. The vulnerability is critical due to its ease of exploitation and severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and implement strict validation and filtering of uploaded files to prevent dangerous file types. Monitor for suspicious activity related to file uploads.