This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), exists in Warehouse Cargo versions up to 2.6.9. It allows authenticated subscribers to upload arbitrary files, potentially enabling remote code execution or other severe impacts. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation can result in full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability allows attackers with subscriber privileges to upload malicious files, which can be executed or used to escalate privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber file upload capabilities where possible and monitor for suspicious file uploads. Avoid exposing the affected versions in untrusted environments.