The vulnerability is an unrestricted file upload that allows an attacker with administrative privileges to place a malicious .tar archive containing PHP code. When the archive is installed, the plugin’s install() method runs with web‑server user privileges, giving the attacker remote code execution. The flaw stems from improper validation of plugin archives, matching CWE‑434.

ProcessMaker Inc. ProcessMaker Community Edition versions earlier than 3.5.4 are affected. No specific sub‑version range is listed; any build older than 3.5.4 carries the flaw.

The CVSS score of 8.6 indicates high severity, and the EPSS score of 32 % shows that exploitation is likely. The vulnerability is not currently cataloged in CISA KEV. Attackers must be authenticated as a user with administrative rights to upload the payload, although chaining with a separate privilege‑escalation flaw can enable exploitation from a lower‑privileged account. Failure to patch enables remote code execution with the web‑server user’s privileges, allowing full control over the affected system.