This vulnerability is an instance of improper input validation that allows an attacker to inject arbitrary command strings through the Central Server's CLAPI generatetraps endpoint, resulting in execution of those commands on the host system. The flaw permits the attacker to bypass normal control mechanisms and gain full control of the server, jeopardizing confidentiality, integrity, and availability of the affected environment.

The flaw impacts Centreon Open Tickets on Central Server for all releases prior to 25.10, 24.10, and 24.04, running on Linux. The affected products include the Centreon web application that hosts the Open Tickets modules.

With a CVSS score of 9.1, the vulnerability is classified as critical and carries a low but present exploitation probability (EPSS < 1%). Although it is not currently listed in the CISA KEV catalog, the combination of high severity and command‑execution capability means that an attacker can compromise the entire system from a web‑based entry point, likely via a crafted CLAPI request. The available official remediation is to upgrade to a patched release; no specific workaround has been published.