A race condition in the /data_api/dl_internal_artifact.php endpoint of Sparx Pro Cloud Server allows an attacker with repository access to download an object, save it as a PHP file, and then execute it before the temporary file is deleted. Because the file persists while the response is still being transmitted, the attacker can issue a second request to trigger execution. This results in remote code execution on the server with the privileges of the web application. The weakness is a classic race condition (CWE-362).

Sparx Systems Pro Cloud Server, specifically version 6.1 build 167 and all earlier builds that were tested and found vulnerable. Versions beyond 6.1 build 167 have not been tested and may also be vulnerable, but no confirmation is available.

The CVSS score of 7.7 indicates a high severity vulnerability. No EPSS score is available, and the flaw is not yet listed in CISA KEV, so current exploitation activity is unknown. The attacker must be able to send web requests to the vulnerable endpoint and have repository access permissions. By delivering a large or slow file, the attacker can extend the race window and then immediately execute the malicious PHP script. This makes the attack relatively easy once the necessary permissions are in place.