The vulnerability CVE-2025-49060 affects CMSSuperHeroes Wastia versions prior to 1.1.3 and allows an unauthenticated attacker to upload files of dangerous types without restriction. This can be exploited to upload a web shell, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on system security. No official patch or mitigation guidance is currently available.

Successful exploitation allows remote attackers to upload malicious files such as web shells, leading to full system compromise including complete loss of confidentiality, integrity, and availability. This can result in unauthorized control over the affected web server and potentially the underlying infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload functionality, implement strict file type validation, and consider disabling uploads if not required. Monitor for suspicious activity related to file uploads.