The vulnerability in xShop’s File Attachment Module permits the upload of arbitrary executable files such as PHP scripts when a user possesses administrative credentials. The upload is not validated for MIME type or file extension, enabling the attacker to deploy a malicious script and then trigger it via the web interface, effectively gaining full control over the web server. The weakness aligns with CWE‑434 "Unrestricted Upload of File with Dangerous Type."

xShop version 3.0.3 is affected. The repository owner is 4xmen, and the fix is released in version 3.0.4. Any deployment running 3.0.3, or earlier builds that have not been upgraded to 3.0.4, remains vulnerable.

The CVSS base score of 9.1 marks this exposure as critical. Although EPSS data is not available, the lack of a KEV listing does not diminish the inherent risk: an authenticated administrator can upload a crafted file from a remote session, then execute it on the server. The attack requires legitimate admin credentials, meaning compromise of or reuse of privileged accounts is a prerequisite. Once an executable is placed, the attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the entire system.