The vulnerability originates from the use of Ruby's eval() function in AlchemyCMS's ResourcesHelper, which processes a string from the resource_handler.engine_name attribute without proper validation. An attacker who can authenticate with administrative privileges can supply malicious code through engine_name, enabling arbitrary system command execution. This flaw falls under the injection category of CWE-95, allowing attackers to compromise the host operating system and all data stored on it.

Affected systems are the AlchemyCMS engine provided by AlchemyCMS. Versions prior to 7.4.12 and 8.0.3 contain the flaw. After applying the updates that replace eval() with the safer send() method, the vulnerability is remedied.

The CVSS score of 6.4 classifies the flaw as moderate severity, but the impact of remote code execution elevates its operational risk. The EPSS score of less than 1% indicates a low probability of widespread exploitation in the wild, and the flaw is not currently listed in the CISA KEV catalog. Nonetheless, only users who have administrative access to the CMS can trigger the vulnerability, so the attack surface is limited to authenticated privileged accounts. Effective patching and strict role separation are essential to mitigate the risk.