The vulnerability CVE-2025-26872 in dkszone Eximius versions up to 2.2 allows an attacker with low privileges to upload files of dangerous types without restriction. This unrestricted file upload can be exploited to execute malicious code or disrupt system operations. The issue is categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official fix has been published by the vendor yet.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized code execution, data breach, and denial of service. The critical CVSS score (9.9) reflects high impact on confidentiality, integrity, and availability. Since the vulnerability allows uploading malicious files without restriction, attackers can leverage this to deploy malware or gain persistent access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload functionality where possible, implement strict file type validation, and monitor for suspicious upload activity. Avoid exposing the vulnerable upload feature to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.