A Cross‑Site Request Forgery flaw in phpBB 3.3.15’s Admin Control Panel icon‑management interface permits a local attacker, who has already authenticated with sufficient privileges, to inject and execute arbitrary code. The vulnerability stems from missing or improperly validated CSRF tokens, allowing the attacker to submit crafted requests that the admin area accepts. The consequence is full control over the application, potentially compromising the underlying operating system and data. This flaw aligns with CWE‑352 for CSRF and CWE‑94 for improper code generation.

Only phpBB 3.3.15 is known to contain this issue. Users running that specific release and accessing the icon‑management feature should verify whether the vulnerability is present. No other vendors or product variants are known to be affected.

The vulnerability cannot be exploited from the external network; it requires a user with local or administrative credentials. While no EPSS score is reported and the flaw is not listed in the CISA KEV catalog, the ability to execute arbitrary code makes the risk significant for affected installations. Administrators should assume that a compromised local account could lead to a full takeover, and therefore prompt remediation is advised.