The vulnerability is a server‑side template injection present in SolusVM 2 up to version 2.0.0-44576. Remote authenticated users can supply malicious template constructs that the system processes with root privileges, allowing an attacker to execute arbitrary code on the host. This flaw directly compromises confidentiality, integrity, and availability through elevated privileges.

It affects the SolusVM 2 platform sold by WebPros, specifically all releases through 2.0.0-44576. Any deployment of SolusVM 2 using those versions is vulnerable; newer releases beyond that version are not listed as affected.

The CVSS score of 9.4 reflects the high severity and full privileges. The EPSS score indicates a very low current exploitation likelihood (<1%), and the vulnerability is not in the CISA KEV catalog. Exploitation requires that the attacker be authenticated within SolusVM; the attacker then injects template syntax via a vendor interface that is parsed and executed by the template engine. If successful, code runs with root rights.