FrontAccounting versions prior to 2.4.20 contain a path traversal flaw that permits authenticated users to write files outside the intended attachments directory. By crafting the unique_name parameter with sequences such as ../../../shell.php and uploading a PHP script without proper extension validation, an attacker can place a file in the web root and execute it as the web server user, thereby achieving remote code execution.

FrontAccounting installations running any release older than 2.4.20 are affected, regardless of deployment type or hosting environment.

The CVSS score of 8.7 marks this flaw as high severity. Because the exploit requires authenticated access and a file upload capability, attackers who can log into the system may execute arbitrary code with the privileges of the web server. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the potential for widespread exploitation in environments where file uploads are enabled warrants immediate attention.