Threats tagged 'ghsa-7g6h-cq22-rqv6'

This vulnerability allows an attacker with access to a valid Poweruser session to achieve remote code execution by uploading specially crafted PNG files containing injected PHP code as desktop backgrounds or lock screens. The uploaded PHP script becomes accessible in the web root and executes when accessed, enabling arbitrary PHP code and OS command execution as the "www-data" user.