The vulnerability CVE-2025-46490 in Crossword Compiler Puzzles allows an attacker with low privileges to upload files without proper restrictions on file types. This unrestricted upload can be exploited to place a web shell on the server, granting the attacker remote code execution capabilities. The issue affects all versions up to 5.2. The CVSS 3.1 score of 9.9 indicates network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to remote code execution on the web server hosting Crossword Compiler Puzzles, resulting in full compromise of the affected system. This includes unauthorized access, data theft, data modification, and potential disruption of service. The critical CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious upload activity as a temporary measure. Avoid exposing the affected application to untrusted networks where possible.