The vulnerability CVE-2025-26776 affects NotFound Chaty Pro versions up to 3.3.3 and allows an attacker to upload files of dangerous types without restriction. This can include web shells, which if successfully uploaded and executed, can lead to full compromise of the affected web server. The CVSS 3.1 base score is 10.0, reflecting a critical severity with network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official vendor patch or remediation guidance as of the published date.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary code on the web server hosting Chaty Pro, leading to full compromise of the server's confidentiality, integrity, and availability. This can result in data theft, service disruption, or further network penetration. The vulnerability is critical with a CVSS score of 10. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing strict file upload restrictions, web application firewalls (WAFs) with rules to block malicious uploads, and monitoring for suspicious file activity. However, these are temporary mitigations and do not replace an official patch.