The vulnerability resides in the GitBuild.php webhook endpoint of php-censor, where an attacker can manipulate the commitId parameter to inject arbitrary operating system commands. This injection flaw allows full control over the host system, potentially compromising confidentiality, integrity, and availability. The CVSS score of 6.9 indicates moderate severity, but the impact is severe if exploited.

All installations of php-censor up to version 2.1.6 are affected. The attack is triggered remotely through the webhook endpoint and does not require authentication.

The exploit has been disclosed publicly and is considered feasible, with an EPSS score of 1%. The vulnerability is not listed in the CISA KEV catalog, but the impact of OS command execution warrants urgent attention. Attackers can trigger the injection via the webhook, and the absence of input validation makes exploitation straightforward.