Craft CMS versions prior to 5.7.5 and 4.15.3 contain a vulnerability where an unauthenticated attacker can externally control a web parameter assumed to be immutable. This flaw allows injection of arbitrary values, including PHP code, into a known local file on the server. The vulnerability has been exploited in the wild and can be chained with another vulnerability (CVE-2024-58136) for potentially greater impact. A fix is available in versions 5.7.5 and 4.15.3.