The vulnerability is an unrestricted file upload that permits authenticated users to upload files with a .php extension encoded in base64. Once stored in the web root, the uploaded file can be accessed and executed by the web server, giving the attacker full remote code execution capability. The flaw is classified as CWE-434, indicating a lack of safe upload type validation.

Volmarg Personal Management System versions up to and including 2.1.0 are vulnerable. The issue can be triggered via the /upload/send/ endpoint, which accepts authenticated file uploads without checking file type or content. Any instance of the application running 2.1.0 or earlier, regardless of deployment environment, falls under this impact.

The CVSS score of 8.6 marks it as a high‑severity vulnerability. EPSS data is not available, but the flaw requires only authenticated access to the upload endpoint, which is likely to be available to many users. It is not listed in the CISA KEV catalog; however, the potential for uncontrolled code execution means it should be treated with urgency. Attackers can exploit the flaw by logging into the system, submitting a PHP file, and then triggering its execution through a browser or script, resulting in full compromise of the web server's privileges.