MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows attackers to execute arbitrary code. By sending crafted requests with malicious PHP code, an attacker can achieve remote code execution, giving full control over the affected server. The weakness is an insufficient input neutralization during execution, classified as CWE‑94, leading to total loss of confidentiality, integrity, and availability for the target system.

The vulnerability affects MetInfo CMS product, specifically releases 7.9, 8.0.0, and 8.1. System administrators should verify if their deployments run any of these versions.

With a CVSS score of 9.3 and an EPSS probability of 11 %, the risk is high. Exploitation requires only unauthenticated HTTP requests containing embedded PHP code, so the attack surface is broad. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants immediate action. An attacker does not need privileged credentials and can trigger the flaw by targeting exposed endpoints that process PHP scripts.