Textpattern CMS contains a path‑traversal flaw in its XML‑RPC handler's mt_uploadImage function. A crafted file.name argument can cause the server to write files outside the designated upload folder. This allows the attacker to create or modify arbitrary files, potentially including executable code, thereby enabling remote code execution. The vulnerability can be reached through the publicly exposed XML‑RPC endpoint.

Textpattern CMS versions 4.9.1 and earlier are affected. The flaw exists across all platforms where the vulnerable PHP script is deployed beneath the web root, and it impacts installations that expose the XML‑RPC interface for image uploads. Versions newer than 4.9.1 are not known to be affected.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. A publicly available exploit demonstrates that attackers can successfully carry out the attack, indicating that the path‑traversal can be exercised remotely. Because authentication requirements are not specified, the attack vector is assumed to be accessible from the public network via the XML‑RPC interface, with no mandatory credentials inferred from the description.