This vulnerability exists in SourceBans Material Admin v1.1.6 within the admin.uploadmapimg.php page, which improperly validates uploaded files. An attacker can exploit this by uploading a maliciously crafted image file, resulting in arbitrary code execution on the affected system. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity and impacts on confidentiality, integrity, and availability. No official fix or patch has been disclosed yet.

Successful exploitation allows remote attackers to execute arbitrary code on the server hosting SourceBans Material Admin v1.1.6, potentially compromising confidentiality, integrity, and availability of the system. This can lead to unauthorized control over the affected application and underlying infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable upload functionality and monitor for suspicious upload activity. Avoid exposing the admin interface to untrusted networks. Do not rely on generic mitigations unless specifically recommended by the vendor.