The flaw is a remote deserialization vulnerability in the getMember function of AuthCloudService.php. By manipulating the cloud_account argument, an attacker can force the application to unserialize crafted data, which can lead to execution of arbitrary code with the permissions of the web server process. The CVE description explicitly states the exploit can originate from outside the host, indicating an exploitation path that targets the backend endpoint directly.

The vulnerability affects the FunAdmin application, specifically all releases up to version 7.1.0‑rc4. The affected releases include rc1, rc2, rc3, and rc4 of the 7.1.0 branch. No other versions or products are listed as impacted.

The CVSS score of 5.1 reflects moderate severity, while the EPSS score of less than 1% signifies a low probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. Based on the CVE description, the attack can be launched remotely by manipulating the cloud_account parameter sent to the backend endpoint, suggesting a web‑based attack vector that does not require privilege escalation or local access.