This vulnerability (CVE-2026-22327) affects Zozothemes Restaurt versions up to 1.0.4 and involves an unrestricted file upload flaw (CWE-434) that permits subscribers to upload files of dangerous types. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and resulting in complete system compromise (confidentiality, integrity, and availability). There is no vendor-provided patch or official remediation level at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with subscriber-level privileges to upload arbitrary files, potentially leading to full system compromise including data theft, data modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber privileges where possible and monitor for suspicious file uploads. Avoid exposing the vulnerable application to untrusted networks if feasible.