A flaw in the session() function defined in Slah CMS 1.5.0 and earlier permits an attacker to execute arbitrary code on the server by submitting specially crafted input. The vulnerability arises from insufficient validation of data passed to the session function, allowing injection of executable payloads. Successful exploitation would give the attacker full control over the affected system, compromising confidentiality, integrity, and availability.

The vulnerability affects Slah CMS installations running version 1.5.0 and any earlier release. Users of these versions should verify their CMS version and apply any available updates.

Because the flaw enables remote code execution, its severity is critical as indicated by a CVSS score of 9.8. The EPSS score is less than 1%, indicating limited current exploitation probability, but the high severity signals a substantial threat. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring that the attacker can send a crafted request to the vulnerable endpoint; no authentication or local privileges are required. While no concrete exploitation evidence is documented, the nature of the vulnerability warrants immediate attention.