The vulnerability arises because the HytaleModding wiki's quickUpload() endpoint validates uploaded files using PHP's finfo MIME type inspection but uses the client-supplied file extension to name the stored file. Since these checks are independent, an attacker can upload a file with a safe MIME type but a .php extension. The file is stored publicly and accessible via URL, enabling execution of arbitrary server-side code. This is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.

Successful exploitation allows an attacker to upload and execute arbitrary server-side code on the affected HytaleModding wiki server. This can lead to full compromise of the server, data theft, or further attacks within the hosting environment. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

At the time of publication, no patches or official fixes are available for this vulnerability. Users should monitor the vendor's advisories for updates. As a temporary mitigation, restrict file upload functionality or implement additional server-side validation to ensure file extensions match MIME types and disallow execution of uploaded files. Consider isolating the upload directory from execution permissions until an official fix is released.