This vulnerability (CVE-2026-40746) affects themagnifico52's Restaurant Zone software versions up to 0.7.8 and involves an unrestricted file upload flaw (CWE-434). Subscribers can upload files of dangerous types without proper validation or restriction, potentially enabling attackers to execute arbitrary code, escalate privileges, or cause denial of service. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation allows an attacker with subscriber-level privileges to upload arbitrary files, which can lead to complete system compromise including full control over the affected system, data breach, and service disruption. The impact is rated critical with high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber upload permissions where possible and monitor for suspicious file uploads. Avoid exposing the upload functionality to untrusted users if feasible.