This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affects Media Library Assistant versions up to 3.39. It permits an authenticated user with high privileges to upload arbitrary files, bypassing file type restrictions. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to full system compromise including unauthorized disclosure, modification, or destruction of data and disruption of service. Because the vulnerability allows arbitrary file upload, it may enable remote code execution or persistent backdoor installation if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege user access and monitor for suspicious file uploads. Avoid exposing the affected application to untrusted networks or users with high privileges.