The vulnerability is an operating‑system command injection flaw driven by manipulation of the xajaxargs parameter in a POST request to /tree/tree_server.php. An attacker can craft input that is passed directly to the shell, enabling execution of arbitrary commands on the host. The exposed flaw is not limited to local use; it can be triggered remotely over the network, granting full control over the underlying operating system once exploited.

This weakness is present in Vaelsys version 4.1.0. No other products or versions are listed as impacted. The vulnerable code resides within the HTTP POST Request Handler component.

The CVSS score of 6.9 indicates a moderate severity impact with remote exploitability. The EPSS score is reported as < 1 %, signaling a very low probability of widespread exploitation at this time, and the vulnerability is not catalogued in the CISA KEV list. The attack requires an attacker to send a crafted HTTP POST request, but no special privileges or authentication are needed beyond the normal access to the web interface. If successful, an attacker can achieve remote code execution with the privileges of the web server process.