This vulnerability in FoxCMS v1.2.5 involves improper handling of file uploads in the LocalTemplate.php controller component. Attackers can upload specially crafted Zip files that lead to arbitrary code execution on the affected system. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code without authentication, potentially leading to full system compromise, data loss, or service disruption. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor file upload functionality and consider disabling the vulnerable component if possible. Avoid exposing the affected service to untrusted networks.