MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code on the web server. By sending crafted HTTP requests that embed malicious PHP code, an attacker can achieve remote code execution and gain full control over the affected server. The weakness arises from insufficient input neutralization during execution, classified as CWE‑94, and can lead to loss of confidentiality, integrity, and availability for the target system.

The vulnerability affects the MetInfo CMS product, specifically releases 7.9, 8.0.0, and 8.1. System administrators should verify whether their deployments run any of these versions.

With a CVSS score of 9.3 and an EPSS probability of 0.26%, the risk remains high due to the critical impact, despite the low exploitation likelihood. It is likely that an attacker can exploit this flaw by sending unauthenticated HTTP requests containing malicious PHP code, making the attack surface broad. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants immediate action.