The vulnerability in FrontAccounting prior to version 2.4.20 involves improper validation of the unique_name parameter in the attachment upload handler. This allows authenticated users to include path traversal sequences (e.g., ../../../shell.php) to write files outside the designated attachments directory, specifically into the web root. Because the application does not validate file extensions, attackers can upload PHP files and execute arbitrary code remotely with the privileges of the web server user.

Successful exploitation enables authenticated attackers to execute arbitrary code on the server by uploading malicious PHP files outside the intended directory. This can lead to full compromise of the web server environment under the web server user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to upload attachments and validate or sanitize file names and extensions at the application level to prevent path traversal and code execution.