CVE-2025-26892 is a CWE-434 vulnerability affecting dkszone Celestial Aura versions up to 2.2. It permits an attacker with low privileges to upload files of dangerous types without restrictions or user interaction, which can lead to full system compromise. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction, and impacts to confidentiality, integrity, and availability. No patch or official fix is currently documented.

Successful exploitation allows an attacker to upload malicious files that can compromise system confidentiality, integrity, and availability. This could lead to unauthorized code execution, data breaches, or denial of service conditions. The vulnerability is critical given the high CVSS score and the broad impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions to trusted users only and implement additional file validation controls if possible. Monitor official vendor channels for updates and apply patches promptly once released.