The vulnerability CVE-2025-47550 affects Themefic Instantio up to version 3.3.16 and involves unrestricted upload of files with dangerous types. This flaw allows an attacker with high privileges to upload a web shell to the web server, which can compromise the system's confidentiality, integrity, and availability. The CVSS 3.1 score is 6.6 (medium), with attack vector network, low attack complexity, high privileges required, no user interaction, and scope changed. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with high privileges can upload a malicious web shell to the server, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized code execution or control over the web server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access and monitor for suspicious file uploads related to the Instantio product.