TextPattern CMS version 4.8.7 contains a flaw classified as CWE-434, permitting authenticated attackers to upload arbitrary PHP files through the CMS’s file upload feature. When a malicious script is uploaded, the attacker can access it via the /textpattern/files/ directory and cause the web server to execute the code, enabling arbitrary command execution with the privileges of the web server process. The impact is therefore a full compromise of the affected installation, as the attacker can run any system command.

The only affected product explicitly listed is TextPattern CMS 4.8.7. No other versions are mentioned in the vendor or CPE data. Consequently, systems running this exact version are at risk unless identical unpatched code paths exist in other releases.

The CVSS score of 8.7 classifies the vulnerability as high severity. While no EPSS score is reported, public exploits are available on exploit‑db, indicating that the flaw has been leveraged in the wild. The attack requires successful authentication to the CMS and use of the file‑upload function, so the vector is authenticated remote. Because the uploaded PHP shell is executed with web‑server privileges, any command can be run. The vulnerability is not present in the CISA KEV catalog, but the high score and existing proof‑of‑concepts warrant prompt remediation.