This vulnerability involves unrestricted file upload functionality in MATCHA INVOICE 2.6.6 and earlier versions. An attacker with administrator privileges can upload files with dangerous types, which may result in arbitrary file creation on the server. This can lead to arbitrary code execution, posing a risk to the integrity and availability of the affected system. The CVSS 3.0 base score is 4.7, reflecting medium severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction.

Successful exploitation allows an administrator to create arbitrary files on the server, which may lead to execution of arbitrary code. This can compromise the server's integrity and availability. The impact is limited by the requirement for administrator privileges, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious file uploads. Avoid granting unnecessary administrator privileges to reduce risk.