The vulnerability originates from a chained import file write and template path traversal flaw that allows an attacker to execute arbitrary code on the host. The weakness is identified as CWE-78, reflecting improper handling of system command execution or file paths. An attacker can leverage this flaw to write malicious files to the server’s file system and then load them as templates, effectively achieving full control over the targeted installation.

The affected product is idno, a social publishing platform. All releases prior to version 1.6.4 are vulnerable. The issue was addressed in release 1.6.4, so any instance running an earlier version should be considered at risk.

The CVSS score of 8.6 indicates a high severity impact. EPSS is below 1%, suggesting that the probability of exploitation observed in the wild is low at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, performed via the web interface, requiring the ability to submit import files and influence template paths. Although no public exploits have been documented, the combination of a remote entry point and the potential to gain code execution warrants immediate attention.