The vulnerability CVE-2025-67924 affects zozothemes Corpkit versions up to 2.0 and involves unrestricted file upload functionality that permits an attacker with low privileges to upload files of dangerous types, such as web shells, to the web server. This can lead to complete compromise of the affected system, including full control over the server's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with high impact on all security properties.

Successful exploitation allows an attacker to upload a web shell, potentially leading to full system compromise including unauthorized access, data theft, modification, and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity to mitigate risk.