The vulnerability lies in the project task export endpoint of WookTeam, where a base64‑encoded data parameter is decoded and directly fed into a PHP eval call after wrapping it with string2array. Because eval receives the raw content when the decoded string begins with "array", an attacker can embed arbitrary PHP code to be executed with the web server's privileges. This flaw therefore provides a straightforward pathway to remote code execution on any system running the affected software.

The flaw affects all deployments of WookTeam version 1.6.6 and earlier. The product name is WookTeam and there are no known vendor identifiers listed. Applications using these versions should verify which version they run and determine whether they are exposed to the vulnerable /api/project/task/export interface.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1%, implying low probability of exploitation in the wild at the moment, and the vulnerability is not listed in CISA’s KEV catalog. Unchecked eval on user input permits remote code execution via crafted requests to the exposed API. Because the description does not mention authentication or network restrictions, it is reasonable to infer that the API is reachable by any client that can reach the host, making the vulnerability potentially exploitable against exposed instances.