This vulnerability (CVE-2026-65461) affects Really Simple CSV Importer versions up to 1.3 and involves unrestricted upload of files with dangerous types by an administrator. The flaw allows an attacker with administrative privileges to upload arbitrary files, potentially leading to full system compromise. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low complexity, high privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrator privileges to upload arbitrary files, which can lead to complete compromise of the system's confidentiality, integrity, and availability. This could enable remote code execution, data theft, or denial of service depending on the uploaded file's nature and server configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious file uploads. Avoid using affected versions in sensitive environments if possible.