The flaw is a cross‑site request forgery in the icon management section of phpBB 3.3.15. A forged request, crafted by an attacker who is logged in as a local administrator, can include malicious payloads that the server executes, resulting in arbitrary code execution on the application server.

Only phpBB version 3.3.15 is affected, specifically its Admin Control Panel icon management feature. No other versions or products are listed as vulnerable.

The vulnerability carries a moderate severity score of 4.3 and is considered very unlikely to be exploited, with an estimated exploitation probability of under 1%. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires the attacker to have administrative credentials and to submit a forged request to the state‑changing icon management endpoint, making the threat surface limited to trusted users with local access.