The vulnerability CVE-2025-68986 in zozothemes Miion (up to version 1.2.7) permits an attacker with low privileges to upload files without proper restriction on file types. This unrestricted file upload can be exploited to place a web shell on the server, allowing remote code execution and complete control over the affected system. The CVSS 3.1 base score of 9.9 reflects the critical nature of this issue with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation allows an attacker to upload a web shell, leading to remote code execution on the web server. This compromises the confidentiality, integrity, and availability of the affected system, potentially resulting in full system takeover. The vulnerability is critical and can be exploited remotely with low privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and consider disabling file uploads if not required. Monitor for suspicious activity related to file uploads and web shell presence.