The vulnerability CVE-2026-39598 in Academy LMS Pro allows an attacker with high privileges to upload files of dangerous types without restriction, potentially leading to remote code execution via web shell upload. The CVSS 3.1 score of 8.0 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no user interaction required. The affected versions are all versions prior to 3.5.2. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to full compromise of the affected web server, including complete loss of confidentiality, integrity, and availability of the system. An attacker can upload and execute arbitrary code via a web shell, potentially leading to further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and implement additional file validation controls if possible.