This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), exists in GP Premium by EDGE22 Studios Ltd. It allows an attacker with at least low privileges to upload files that can be executed remotely, resulting in remote code inclusion. The affected versions include all releases up to and including 2.5.5. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the vulnerability is publicly disclosed as of August 18, 2026.

Successful exploitation can lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying host. This poses a critical risk to systems running vulnerable versions of GP Premium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable application to untrusted users where possible.