A remote attacker may inject malicious payloads into the chat input field of the Greek Universities Network Open eClass Platform, leading to arbitrary code execution on the server. This flaw violates the integrity and confidentiality of the application and can allow attackers to compromise the entire platform, potentially gaining elevated privileges and access to sensitive data. The flaw is a classic example of code injection, allowing malicious commands to be run within the platform's runtime environment.

Greek Universities Network (GUnet) Open eClass Platform version 3.15 is affected. The vulnerability resides in the course module's chat feature and is likely present on any deployment of this platform using that version. All institutions hosting the platform without applying a fix are potentially at risk.

The CVSS score of 9.8 underscores the severity of the remote code execution flaw, which can be triggered by injecting malicious content into the chat input with minimal user interaction. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. The absence of a vendor patch at this time raises the risk level, suggesting that attackers could readily exploit the flaw if they can identify a target using the affected platform.