The vulnerability is a file upload validation bypass in HAXCMS PHP, which allows attackers to upload files with spoofed image extensions while the content is not validated. This flaw permits the uploading of malicious PHP code that can run on the web server, leading to remote code execution if an attacker can place a script on the server. The weakness is classified as CWE‑434, a missing file type validation flaw.

Affected servers are those running HAXCMS PHP versions 11.0.6 through just before 25.0.0. Users who have not upgraded beyond 25.0.0 remain exposed while using the PHP backend that supports file uploads. The fix is included in version 25.0.0 and later, making it a clear upgrade path.

The CVSS score of 8.7 denotes a high severity risk, and with a public upload interface the attack vector is remote over the web. Because the flaw accepts any content disguised as an image, an attacker can upload a web shell or other executable payload and trigger its execution by accessing the file via HTTP, potentially compromising the entire application. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the severity still warrants prompt action.