The vulnerability CVE-2026-36722 affects bookcars v8.3 and involves an authenticated arbitrary file upload issue in the /api/create-car-image endpoint. Attackers who are authenticated can upload specially crafted files, potentially enabling them to execute arbitrary code on the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. No official fix or patch information is provided in the available data.

Successful exploitation could allow an authenticated attacker to execute arbitrary code on the affected system by uploading malicious files through the vulnerable API endpoint. This could lead to partial compromise of confidentiality and integrity of the system. Availability impact is not indicated. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/create-car-image endpoint to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary authentication privileges that could be leveraged to exploit this vulnerability.