This vulnerability (CVE-2026-27064) affects EverPress Mailster up to version 4.1.17 and involves an unrestricted file upload flaw in the editor functionality. It allows an attacker with high privileges to upload arbitrary files without proper validation of file types, potentially leading to full system compromise. The CVSS 3.1 base score is 9.1 (critical), indicating network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation can result in arbitrary file upload, enabling attackers to execute malicious code, alter or destroy data, and disrupt service availability. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the editor functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the affected versions in untrusted environments.