A flaw in Evolution CMS version 3.1.6 lets an authenticated account that can create modules inject PHP code into module parameters. The injected code is executed when the module is triggered, allowing arbitrary system commands to run with the web server’s privileges. This is a classic code‑injection weakness (CWE‑94).

The vulnerability affects Evolution CMS, specifically the 3.1.6 release. No other versions are listed as affected. Only users who can authenticate and acquire module‑creation permissions have the necessary privileges to exploit the flaw.

The CVSS score of 8.7 indicates high severity. Because the EPSS score is not available, the exploitation probability cannot be quantified, though the feature required to execute code is user‑controlled. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, reducing the signal that the flaw is actively targeted. Successful exploitation requires a legitimate, module‑creation‑permitted user and access to the /manager/index.php endpoint, implying that appropriate access controls must be in place to mitigate risk.