The vulnerability arises from the Event::loadFromArray function in the Remote Event Queue Endpoint of Open‑Web‑Analytics. Deserialization of untrusted input permits an attacker to control the payload, potentially leading to arbitrary code execution on the host. The weakness aligns with CWE‑20 (Input Validation) and CWE‑502 (Deserialization of Untrusted Data), and the flaw can be triggered by a remote request, making it a medium‑severity flaw according to CVSS 6.9.

Affected systems are instances of Open‑Web‑Analytics up to and including version 1.8.1. The flaw resides in the queue.php component of the Remote Event Queue Endpoint, and any deployment using those releases without the 1.8.2 patch is vulnerable.

Because the flaw is remotely triggerable, an attacker with network access to the affected endpoint can send crafted input and achieve code execution, provided the web application permits that endpoint to be reached from untrusted networks. The CVSS score of 6.9 reflects this risk, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Nonetheless, the remote nature of the attack vector warrants prompt remediation.