The vulnerability arises from an improper validation of files contained inside the zip archive used for theme imports. An attacker who can authenticate as an administrator can upload a malicious archive that contains executable code, which the web server then places onto the filesystem without restrictions. This allows the attacker to execute arbitrary code on the server. The weakness is classified as CWE‑434, Unrestricted Write to File or Directory.

Affected systems include the Open eClass course‑management platform distributed by gunet. All releases earlier than version 4.2 are vulnerable; the vendor released a patch v4.2 that corrects the file validation logic. Users running any older release are at risk.

The CVSS score of 7.3 indicates a high-risk flaw, but the EPSS score of less than 1 % suggests a very low chance of public exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need administrative privileges to upload the malicious archive, so the threat is mainly to privileged users or compromised accounts. Despite the low exploitation probability, the impact of remote code execution warrants immediate remediation.