Wavelog exposes installation endpoints that allow an unauthenticated attacker to write arbitrary PHP configuration data. The unsanitized input is forwarded to the write_configfile routine, enabling the attacker to place arbitrary PHP code into configuration files which will then be executed on the server. The resulting remote code execution compromises confidentiality, integrity, and availability of the system, giving the attacker full control over the web host.

All versions of Wavelog from 1.8 up to and including 2.4.1 are vulnerable. The vulnerability was resolved in release 2.4.2. Any installation that has not been updated to 2.4.2 or later is impacted, regardless of system configuration.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of <1% shows only a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness simply by sending HTTP requests to the exposed installation endpoints without authentication; no special privileges are required. An attacker can read or write log files and inject PHP configuration that executes code on the server, effectively gaining full control over the application and possibly the underlying host.