This vulnerability (CVE-2026-56058) affects Quform versions up to 2.23.0 by allowing authenticated subscribers to upload files of dangerous types without proper validation, categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the vulnerability is not related to a cloud service. Exploits are not known to be in the wild at this time.

Successful exploitation allows an attacker with subscriber-level privileges to upload arbitrary files, potentially leading to full system compromise including data theft, data modification, and service disruption. The vulnerability's CVSS score of 9.9 indicates critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber upload permissions where possible and monitor for suspicious file uploads. Avoid granting unnecessary upload privileges to low-privilege users.