The vulnerability is an incorrect access control flaw that allows any user, even unauthenticated, to inject arbitrary PHP code into the PreExecuteCode attribute of any report in reportico-web up to version 8.1.0. This flaw encompasses improper authorization checks (CWE-284). If exploited, the injected code runs within the web server's PHP engine, giving the attacker full control over the host system.

Affected systems are installations of reportico-web version 8.1.0 and earlier. Reportico-web is a PHP reporting framework used to generate dynamic reports in web applications. The vulnerability is present wherever the PreExecuteCode field can be accessed without authentication, regardless of the server's safe_mode setting.

The flaw can be leveraged through web requests that populate or modify the PreExecuteCode field, a path that requires no authentication and therefore is highly susceptible. The CVSS base score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests the probability of exploitation is low but non‑zero. Because the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, no active exploits have been reported, but the potential for immediate remote code execution remains significant.