A local low‑privileged user can elevate privileges by editing a world‑writable command manifest, causing the application to execute arbitrary commands as an administrator. This flaw allows arbitrary code execution with elevated rights, compromising confidentiality, integrity, and availability of the system. The underlying weakness is incorrect permission assignment for a critical resource.

The vulnerability affects INFINITT Healthcare’s System Manager software. No specific product versions are listed in the advisory, so all installed instances should be verified for the presence of the world‑writable execlist.txt file.

Because the attack requires local access and a user account with limited privileges, the risk is confined to environments where users can write to execlist.txt. No CVSS or EPSS score is provided, and the vulnerability is not noted in CISA’s KEV catalog. However, the potential for complete administrator takeover makes the flaw critical if the susceptible file remains world‑writable.