This vulnerability, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affects IT Residence software versions up to 3.2.1. It allows authenticated subscribers to upload arbitrary files without proper validation of file types, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-74014 but lacks an official remediation or patch at this time.

Successful exploitation can lead to full system compromise including unauthorized disclosure, modification, and destruction of data. The vulnerability affects confidentiality, integrity, and availability at a critical level. Since the flaw allows arbitrary file uploads, attackers could potentially execute malicious code on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber file upload permissions, implement manual file type validation, and monitor for suspicious uploads as temporary mitigations.