The vulnerability CVE-2025-30933 in LiquidThemes LogisticsHub allows an unauthenticated attacker to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the affected server. The issue affects all versions up to and including 1.1.6. The CVSS 3.1 base score is 10.0, reflecting the critical nature of the vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server hosting LogisticsHub, leading to full system compromise. This can result in data theft, service disruption, and further lateral movement within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality, implement strict file type validation, and monitor for suspicious uploads as interim mitigations.