Aero CMS 0.0.1 contains a PHP code injection flaw that lets authenticated attackers run arbitrary PHP code by uploading malicious files through the image parameter on the admin posts.php page. The flaw is triggered when a user adds a post via the source=add_post parameter; the uploaded file is saved and executed by the server. This allows an attacker who can authenticate as an administrator to gain remote code execution on the web server.

The affected product is MegaTKC Aero CMS version 0.0.1. No other versions are mentioned, so any deployments running this release are vulnerable.

The CVSS base score is 8.7, indicating a high‑severity threat. There is no EPSS score available, which means we cannot quantify the current exploitation probability. The vulnerability is not listed in CISA's KEV, so no known exploits have been reported to that database. Because the flaw requires authentication to the admin area, the attack vector is remote via the web interface but depends on the attacker having valid admin credentials. Once authenticated, the attacker can upload a file that is later processed and executed by the server, granting full control over the application and server.