The vulnerability in freo2 provided by refirio permits unrestricted upload of files with dangerous types. Specifically, an administrative user can upload executable files, which can then be used to execute arbitrary OS commands. This represents a critical security risk as it allows high-privilege users to potentially compromise the underlying system. The CVSS 3.0 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with highest-level administrative privileges can upload and execute arbitrary executable files on the system running freo2. This can lead to full system compromise, including unauthorized access, data manipulation, and service disruption.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted personnel only and monitor for suspicious file uploads.