A flaw in codelibs Fess version 15.5.1 and earlier allows an attacker to submit arbitrary code through the content argument of the AdminDesignAction.update method. The unvalidated input can be executed by the JSP File Handler, giving the attacker the ability to run malicious code on the server. The weakness is catalogued as CWE-74 and CWE-94, and the description states that the exploit may be performed from remote and that the vulnerability has been publicly disclosed.

codelibs Fess, all releases up to and including 15.5.1 are affected. No specific policy or patch level is noted beyond the general statement that the vulnerability exists in these versions.

The CVSS score of 5.1 places the issue in the medium severity range, but the lack of further mitigation or vendor response, combined with a publicly available exploit, raises the likelihood of real‑world use. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector, inferred from the description, is a remote web‑application request that manipulates the content parameter of the design file update feature. No additional exploitation conditions are described beyond remote access to the vulnerable JSP endpoint.