This vulnerability resides in the ZIP File Handler component of DouPHP through the admin/file.php endpoint. Manipulation of the sql_filename parameter allows an attacker to upload any file without restriction. Because the uploaded file can contain executable code, an attacker can potentially run arbitrary code on the host. This flaw is classified as an untrusted content upload and improper access control.

The issue affects all installations of DouPHP up to and including version 1.9. No later versions are presently known to contain the fix. Administrators using the bundled admin/file.php page are therefore at risk unless they upgrade beyond 1.9 or take mitigations.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score shows a very low but nonzero likelihood of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely, so any machine with visible /admin/file.php and a writable upload directory is a potential target. Because no known exploit code is publicly available, the chance of immediate exploitation is low, but the potential impact of remote code execution warrants timely remediation.