PbootCMS version 3.2.15 contains a flaw that permits an attacker to inject and execute arbitrary code through several core controller files, including MemberController, UserController, CommentController, ContentController, and helper.php. Because these components handle user input without proper validation, a malicious actor can run arbitrary PHP code on the CMS host, gaining full control of the server and all data it stores.

Any deployment of PbootCMS 3.2.15 is vulnerable. The issue affects the core PHP controllers listed in the description, and there is no evidence that later releases mitigate the problem, so installations of 3.2.15 must be reviewed.

The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw – remote code execution – indicates a high potential impact. Based on the description, it is inferred that attackers would likely trigger the vulnerability by sending crafted HTTP requests to the affected controller URLs. Since the flaw is in the application layer, it can be exploited from any network location that can reach the CMS web interface.