The vulnerability CVE-2026-24960 affects zozothemes Charety versions before 2.0.2 and involves unrestricted upload of files with dangerous types. This allows an attacker with low privileges to upload malicious files remotely without requiring user interaction. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory information is provided in the input data.

Successful exploitation can lead to full system compromise, including unauthorized disclosure of information, modification of data, and disruption of service. The vulnerability is critical due to the high CVSS score and the ability to upload malicious files remotely with low privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity as temporary mitigations.