This vulnerability in Kiamo before version 8.4 permits authenticated administrators to execute arbitrary PHP code on the server, classified under CWE-94 (Improper Control of Generation of Code). The vendor considers this behavior a historical and intended feature rather than a flaw, limiting access to users with administrator privileges. Version 8.4 introduced restrictions on certain PHP functions to reduce the risk. The CVSS score is 8.8, indicating high impact with network attack vector, low attack complexity, and privileges required. No official patch or remediation guidance is currently available.

Successful exploitation allows an authenticated administrator to execute arbitrary PHP code, potentially leading to full system compromise, including confidentiality, integrity, and availability impacts. Since the feature is intended for administrators, the risk is limited to users with elevated privileges. No known exploits have been reported in the wild.

No official patch or remediation level has been published. Version 8.4 introduces restrictions on some PHP functions, which may reduce risk. Organizations should consider upgrading to version 8.4 or later where these restrictions are applied. Since this functionality is intended for administrators, ensure strict access control and monitoring of administrator accounts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.