The vulnerability CVE-2025-54693 affects the epiphyt Form Block product through version 1.5.5. It allows an unauthenticated attacker to upload files without proper restrictions on file types, including potentially malicious web shells. This can result in complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and scope change with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell, leading to full control over the web server. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to the potential for remote code execution and system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable file upload functionality in the Form Block component where possible. Implement network-level controls to limit exposure of the affected service and monitor for suspicious file uploads. Avoid relying on this component in untrusted environments until patched.