The vulnerability allows a remote attacker who has administrator credentials to supply a template name that the system writes directly to a file path. This capability lets the attacker create or overwrite arbitrary files outside the expected template directory, which can then be executed as code. The weakness is a classic path traversal flaw (CWE-23) that compromises confidentiality, integrity, and availability by enabling attackers to run malicious code on the server.

The affected product is LibreBooking. The advisory notes that versions prior to 5.1.0 are vulnerable, while 5.1.0 and later contain a fix.

Based on the description, the likely attack vector is the email template editor's save action, which accepts template names and writes them to disk without sanitization. Based on the CVSS score of 8.6, it is inferred that the vulnerability is of high severity. Exploitation requires administrator privileges, limiting attacks to users with elevated rights. From the extremely low EPSS score of <1%, it is inferred that the probability of exploitation in the general population is low. The fact that it is not listed in CISA's KEV catalog further suggests that there are currently no known widespread deployments or active exploits. Detection is expected to rely on identifying the presence of the vulnerable code path and reviewing file access logs for suspicious derivatives. Nonetheless, the potential to execute arbitrary code necessitates prompt remediation.