The vulnerability is an operating‑system command injection flaw driven by manipulation of the xajaxargs parameter in a POST request to /tree/tree_server.php. An attacker can craft input that is passed directly to the shell, enabling execution of arbitrary commands on the host. The exposed flaw is not limited to local use; it can be triggered remotely over the network, granting full control over the underlying operating system once exploited.

This weakness is present in Vaelsys version 4.1.0. No other products or versions are listed as impacted. The vulnerable code resides within the HTTP POST Request Handler component.

The CVSS score of 6.9 indicates a moderate severity impact with remote exploitability. The EPSS score is 5%, signaling a very low probability of widespread exploitation at this time, and the vulnerability is not catalogued in the CISA KEV list. The attack requires an attacker to send a crafted HTTP POST request; whether authentication is required is not specified in the source, so this is inferred. If successful, an attacker can achieve remote code execution with the privileges of the web server process.