The vulnerability originates from an unrestricted file upload in BuilderEngine 3.5.0 where the elFinder 2.0 file manager fails to enforce file type or storage restrictions. The underlying jQuery File Upload component accepts any file without validating its MIME type or destination, allowing an attacker to upload a malicious .php file that the web server then executes. This flaw is a classic example of CWE-434 (Unrestricted Upload of a Dangerous Type) compounded by CWE-20 (Improper Input Validation) and CWE-306 (Missing Authentication for a Critical Function). If exploited, the attacker gains complete control over the web server process, can modify or delete data, and potentially pivot to other network assets.

This issue affects installations of BuilderEngine CMS version 3.5.0. No other versions are mentioned in the advisory and no additional releases are indicated as vulnerable.

The CVSS score of 9.3 marks it as critical, and the EPSS score of 79% reflects a high likelihood of exploitation. Although it is not listed in the CISA KEV catalog, the attack path is straightforward: unauthenticated users can submit a file via the upload endpoint, causing the server to execute it. Because the flaw permits arbitrary PHP files, an attacker can achieve full system compromise, tamper with data, or move laterally to other resources.