The vulnerability CVE-2025-39436 affects aidraw's I Draw product versions up to and including 1.0. It involves an unrestricted file upload flaw where files of dangerous types can be uploaded without proper validation or restrictions. This can be exploited by an attacker with high privileges to execute arbitrary code or cause denial of service, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on system security properties. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker with high privileges to upload malicious files, potentially leading to full system compromise including loss of confidentiality, integrity, and availability. The vulnerability is critical given the high CVSS score and the nature of unrestricted dangerous file uploads. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and implement additional file validation controls if possible. Monitor for updates from the vendor regarding patches or official mitigations.