An issue in Kiamo before version 8.4 allows an attacker who is already authenticated as an administrator to execute arbitrary PHP code on the server, which is a direct remote code execution flaw (CWE‑94). Based on the description, it is inferred that executing arbitrary PHP would allow the attacker to read, modify, or delete any files accessible to the web server, thereby compromising data confidentiality, integrity, and potentially the underlying operating system. The vendor acknowledges this as a historical administrative feature, accessible only to users with explicit admin privileges, and notes that restrictions on certain PHP functions were added in version 8.4.

All Kiamo installations running a version earlier than 8.4 are affected. No other products or versions are listed as impacted.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not included in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated as an administrator, meaning a prior compromise of administrative credentials is necessary before the arbitrary code can be executed.