The vulnerability CVE-2025-68553 in zozothemes Lendiz (versions prior to 2.0.1) allows an attacker with low privileges to upload files without proper restrictions on file types. This can be exploited to upload a web shell, granting remote code execution capabilities on the affected web server. The vulnerability is critical with a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue affects all versions before 2.0.1, but no patch or official fix details are currently provided.

Successful exploitation allows an attacker to upload malicious files such as web shells, leading to remote code execution on the web server. This compromises the confidentiality, integrity, and availability of the affected system, potentially resulting in full system takeover. The vulnerability requires only low privileges and no user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity as interim mitigations.