The mojoomla Hospital Management System contains an unrestricted file upload vulnerability (CVE-2025-39380) that permits attackers to upload malicious files such as web shells to the web server. This vulnerability affects all versions up to 47.0 released on or before November 20, 2023. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No patch or mitigation details are currently provided by the vendor or advisory sources.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary code on the affected server, resulting in full system compromise. This includes the ability to execute commands remotely, access sensitive data, modify or delete information, and disrupt service availability. The critical CVSS score reflects the high risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality, implement strict file type validation, and monitor for suspicious uploads as temporary mitigations. Avoid exposing the affected system directly to untrusted networks.