The vulnerability CVE-2025-68555 affects zozothemes Nutrie versions prior to 2.0.1 and allows an attacker with low privileges to upload files of dangerous types without restriction. This can lead to uploading a web shell, potentially resulting in full compromise of the web server. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell to the affected server, leading to complete compromise of the web server's confidentiality, integrity, and availability. This can result in unauthorized remote code execution and control over the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious file uploads as a temporary measure. Avoid exposing the upload functionality to untrusted users where possible.