This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), exists in Smart Cleaning versions up to 4.8.6. It allows authenticated subscribers to upload arbitrary files without proper restrictions on file types, potentially enabling remote code execution or other severe impacts. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with subscriber-level privileges to upload malicious files, potentially leading to full system compromise including data theft, system manipulation, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber file upload permissions and monitor for suspicious file uploads where possible.