This vulnerability (CVE-2024-37442) in Photo Gallery by Ays is classified as CWE-74, involving improper neutralization of special elements in output that are used by a downstream component, leading to code injection. The issue affects versions prior to 5.7.1, though specific affected versions are not detailed. The CVSS 3.1 base score is 3.8 (low), with attack vector network, low attack complexity, requiring high privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No official patch or remediation guidance is currently available from the vendor, and no exploits are known in the wild.

The vulnerability allows an attacker with high privileges to perform code injection via improperly neutralized output elements. While it does not impact confidentiality, it can lead to limited integrity and availability issues. The low CVSS score reflects the requirement for high privileges and the limited scope of impact. No known exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is available, users should monitor for updates from the Photo Gallery Team and apply any future patches promptly. Until then, restricting high privilege access and reviewing output handling may reduce risk.