This vulnerability affects Kiamo versions before 8.4 and permits authenticated administrative users to execute arbitrary PHP code on the server. The issue arises from insufficient restrictions on code execution capabilities granted to administrative users. No CVSS score or detailed technical exploit information is provided. The vulnerability is publicly disclosed but lacks vendor remediation details or patch availability.

Successful exploitation allows an authenticated administrative attacker to execute arbitrary PHP code on the server, potentially leading to full system compromise, data breach, or service disruption. Since administrative privileges are required, the risk is limited to users with such access. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity. Avoid granting administrative privileges unnecessarily.