This vulnerability in PHPVibe v11.0.46 involves directory traversal due to insufficient blacklist and directory validation. An attacker can exploit this flaw to write specific statements to .htaccess files and inject code into files with a .png suffix, enabling code execution on the affected system. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. This could allow an attacker to execute arbitrary code with the privileges of the web server process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected PHPVibe installation and monitor for suspicious file modifications related to .htaccess or .png files.