This vulnerability in Farost Energia versions up to 1.1.2 allows an attacker to upload files without proper restrictions on file types. Specifically, it permits uploading a web shell, which can be used to execute arbitrary code on the web server. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without any privileges or user interaction, and it results in complete confidentiality, integrity, and availability compromise of the affected system.

Successful exploitation allows an unauthenticated remote attacker to upload and execute arbitrary code on the affected web server, leading to full system compromise including data theft, modification, and service disruption. The vulnerability is rated critical with a CVSS score of 10.0, reflecting the highest severity and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality, implement strict file type validation, and monitor for suspicious uploads as temporary mitigations.