Snews CMS version 1.7 is vulnerable to an unrestricted file upload flaw that permits attackers to upload any file, including PHP executables, to the snews_files directory through a multipart form-data endpoint. Once an attacker uploads a malicious PHP script, they can trigger its execution by navigating to the file’s URL, thereby gaining complete remote code execution on the host. This vulnerability directly compromises confidentiality, integrity, and availability by allowing arbitrary code to run with the privileges of the web application process.

The flaw affects the Snewscms product known as Snews CMS, specifically version 1.7. No other versions are listed as impacted, and the issue centers on the snews_files upload path within the application.

The CVSS score of 9.3 marks it as a critical vulnerability, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. It is not included in CISA’s KEV catalog, indicating no known large‑scale attacks at the time of reporting. The attack vector is inferred to be unauthenticated, HTTP‑based requests to the web server performing the file upload, as the description indicates direct access to the upload endpoint without authentication. The vulnerability can be exploited by any entity that can reach the exposed upload URL.