This vulnerability (CVE-2026-40746) affects Restaurant Zone versions <= 0.7.8 and involves unrestricted upload of files with dangerous types by subscribers. This can enable attackers with subscriber privileges to upload malicious files, potentially leading to complete compromise of confidentiality, integrity, and availability of the system. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges of low (subscriber), no user interaction, and scope change with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with subscriber-level privileges to upload arbitrary files, potentially leading to full system compromise including data theft, data modification, and denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber file upload capabilities where possible and monitor for suspicious file uploads as a temporary measure.