This vulnerability (CVE-2026-65548) affects Muffingroup Betheme versions <= 28.4.2 and is classified as CWE-94: Improper Control of Generation of Code, commonly known as code injection. It allows a contributor-level user to perform remote code execution (RCE) without requiring user interaction. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official remediation or patch information is provided in the available data, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker with contributor-level privileges to execute arbitrary code remotely on the affected system. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Muffingroup's official channels for updates. Until a patch is available, restricting contributor privileges and applying strict access controls may reduce risk.