This vulnerability involves arbitrary PHP code execution by authenticated administrative users in Kiamo versions before 8.4. Although this behavior is described by the supplier as an intended feature for administrators, it poses a significant risk if administrative credentials are compromised. Version 8.4 introduced restrictions on certain PHP functions to reduce the potential impact of this capability. There is no official remediation level or patch explicitly stated, and no known exploits in the wild have been reported.

An attacker with authenticated administrative access can execute arbitrary PHP code on the affected server, potentially leading to full system compromise, including confidentiality, integrity, and availability impacts. Because the feature is intended for administrators, the risk primarily arises if administrative credentials are stolen or misused.

The vendor has added restrictions on some PHP functions starting with version 8.4, which reduces the risk. Users should upgrade to Kiamo 8.4 or later to benefit from these mitigations. Since this is an intended administrative feature, no additional vendor-provided patches or fixes are currently available. Organizations should ensure strict control and monitoring of administrative access to limit exposure.