Shopizer versions up to 2.16.0 contain a critical path traversal vulnerability in the /content/images/add endpoint. This flaw allows unauthenticated attackers to write arbitrary files to any writable location on the server by sending a crafted POST request. The vulnerability has a CVSS 3.1 base score of 10.0, indicating maximum severity with complete confidentiality, integrity, and availability impact.