This vulnerability involves a race condition (CWE-362) in Sparx Systems Pro Cloud Server's /data_api/dl_internal_artifact.php endpoint. The server downloads object properties based on a guid parameter and saves the content as a file in the current directory. An attacker controlling filename and content can create a malicious PHP file. Due to improper synchronization, if response transmission is slow, the file remains accessible temporarily, enabling a second request to execute it, resulting in remote code execution. The vendor was notified but did not disclose affected versions beyond confirming vulnerability in version 6.1 (build 167) and earlier.

Successful exploitation allows an attacker with repository access to achieve remote code execution on the server by exploiting a race condition that leaves a malicious PHP file accessible temporarily. This can lead to full compromise of the affected system. The CVSS 4.0 score is 7.7 (high severity), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but partial user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should restrict repository access to trusted users only and monitor for unusual activity. Avoid using affected versions (6.1 build 167 and below) in exposed environments until a patch or official mitigation is available.