Server‑side template injection in PDF Signer 3.0 occurs through the CSRF‑TOKEN cookie, allowing attackers to inject PHP commands such as shell_exec() into cookie values. This flaw is exploitable without authentication and can lead to arbitrary system command execution, data theft, and full compromise of the affected server.

The vulnerability affects Simcy Creative's PDF Signer 3.0. No other affected versions were disclosed in the advisory, so the only known vulnerable release is the 3.0 edition.

The CVSS score of 9.3 indicates critical severity. An unauthenticated attacker can craft a malicious CSRF‑TOKEN cookie, bypass CSRF defenses, and drive code execution without needing to log in. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but the high CVSS combined with the lack of authentication requirement means the risk is high and exploitation is likely if attackers target the product.