HaPe PKH 1.1 contains an arbitrary file upload flaw that lets an authenticated user bypass file type validation and upload PHP files, enabling the attacker to run arbitrary code on the server. The weakness is a classic file upload validation failure, classified as CWE-434. The impact is the ability to execute arbitrary server‑side code, potentially giving control over the entire web application or even the underlying operating system.

The vulnerability affects Sitejo’s HaPe PKH 1.1. Malicious files can be uploaded through several endpoints—aksi_foto.php, aksi_user.php, and aksi_kecamatan.php—and require the attacker to be authenticated within the application. No specific version range beyond 1.1 is listed, so all installations of HaPe PKH 1.1 are potentially impacted.

The CVSS score of 8.7 indicates a high‑severity flaw, and the EPSS score is not available. It is not listed in CISA’s KEV catalog. Because the exploit requires a valid user session, the attack vector is “Authenticated user interacting with a web interface.” Exploitation is straightforward once the attacker logs in: they can upload a PHP file and then access it via the web server to execute code. The resultant risk includes full remote code execution, data exfiltration, or further lateral movement on the host.