The flaw is in the admin tools interface of DefaultFuction Content‑Management‑System 1.0, where the host parameter is concatenated into a system command without proper validation. This allows an attacker to inject arbitrary operating system commands, leading to remote command execution. The vulnerability is categorized as OS Command Injection (CWE‑74 and CWE‑77). Successful exploitation would compromise the confidentiality, integrity, and availability of the targeted web server, potentially allowing full system compromise.

Only the 1.0 release of DefaultFuction Content‑Management‑System is affected. All installations of that version, identified by the vendor’s GitHub repository, are vulnerable. No other versions or products are known to be impacted at this time.

The CVSS score of 6.9 classifies the issue as moderate severity, while the EPSS score of 1 % indicates a low current exploit probability; however, a public exploit has already been released, so attackers could still target the system. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be carried out remotely by sending a crafted HTTP request to /admin/tools.php with a malicious host value; the documentation does not state that authentication is required, implying the endpoint is accessible to unauthenticated users.