A vulnerability exists in the /admin/edit_posts.php file of code‑projects Content Management System 1.0 that allows an attacker to manipulate the image parameter and upload files without restriction. This flaw permits any file type, including executable code, to be placed on the server. If the uploaded file is processed or executed, the attacker could gain remote code execution, compromise data integrity, or deface the site. The weakness is characterized by CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

The affected product is code‑projects Content Management System version 1.0. The vulnerability is identified in the admin edit_posts.php component and is present in the base release referenced by the CPE cpe:2.3:a:code-projects:content_management_system:1.0.*.

The CVSS base score of 5.1 indicates moderate severity. The EPSS score is less than 1%, showing a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Because the flaw allows unrestricted file uploads, an attacker can perform the attack remotely without authentication. If the server parses or executes the uploaded content, the attacker can execute arbitrary code or modify site data. While no active exploit is currently known in the wild, the capabilities remain, so monitoring and mitigation are recommended.