The vulnerability identified as CVE-2025-58963 affects 7oroof Medcity versions before 1.1.9 and allows attackers to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the web server. The CVSS 3.1 base score is 10.0, reflecting critical severity with network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. The vulnerability was published on 2025-10-22, with no patch or mitigation details currently available. The product is not a cloud service, so remediation depends on vendor patching or user action.

Successful exploitation of this vulnerability allows an unauthenticated attacker to upload a malicious web shell to the affected server, resulting in full system compromise. This includes complete loss of confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of the vulnerability, the impact is severe and could lead to unauthorized access, data theft, service disruption, or further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality, implement strict file type validation, and monitor for suspicious uploads as temporary mitigations. Since no vendor advisory or patch links are provided, users should closely follow 7oroof's official channels for updates and apply patches promptly once released.