This vulnerability in mjperpinosa stumasy allows an attacker to perform an unrestricted file upload by manipulating the pr_profile_image parameter in the change_profile_image.php script. The exact function affected is unspecified. The product's rolling release nature means no discrete versioning information is available for affected or fixed releases. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. No vendor response or patch is currently documented.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to further compromise depending on the server configuration and file handling. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should monitor for updates from the vendor. Until a patch is released, consider restricting file upload functionality, validating and sanitizing uploaded files, and applying other relevant access controls as temporary mitigations.