The flaw exists in the default admin tools interface of DefaultFuction Content‑Management‑System 1.0, where the host argument is unsanitized and concatenated into a system command. This lack of input validation allows a malicious value to be injected, resulting in arbitrary operating system command execution. The vulnerability is formally identified as OS Command Injection, mapping to CWE‑74 and CWE‑77. Successful exploitation would compromise the confidentiality, integrity, and availability of the victim web server, potentially giving full system control to an attacker.

Only the 1.0 release of DefaultFuction Content‑Management‑System is affected. All installations of that version, identified by the vendor’s GitHub repository, are vulnerable. No other versions or products are known to be impacted at this time.

The CVSS score of 6.9 classifies the issue as moderate severity, while the EPSS score of 3 % indicates a low current exploit probability; however, a public exploit has already been released, so attackers could target the system. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be carried out remotely by sending a crafted HTTP request to /admin/tools.php with a malicious host value; based on the description, it is inferred that the endpoint is accessible to unauthenticated users.