The vulnerability is in the Stumasy application, affecting the calculate.php file that uses the eval function. The mathematical_sentence argument can be manipulated to inject arbitrary PHP code; the injection leads to Remote Code Execution. The flaw is classified as CWE-74 (Input not properly neutralized) and CWE-94 (Code generated in an unsafe manner).

Any installation of the mjperpinosa Stumasy product running versions prior to the undecided fix is impacted. Because the project uses a rolling release model, no precise release number is available, but any state before the commit that addresses the issue remains vulnerable.

The CVSS score is 6.9, indicating a medium to high severity. The EPSS score is less than 1%, suggesting a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the exploit is publicly available and can be carried out remotely. An attacker without authentication can send a crafted request to calculate.php to execute arbitrary code, making the risk significant for publicly accessible deployments.