A critical code injection vulnerability in Raytha CMS allows privileged users to execute arbitrary code within the hosting environment, posing a severe risk of full system compromise.

This is a code injection vulnerability (CWE-94) occurring within the Functions module. While the vulnerability requires high privileges to trigger, it allows an authenticated user to bypass intended restrictions and execute arbitrary .NET code in the underlying server environment.

The ability to execute arbitrary code on the server hosting the CMS can lead to complete loss of confidentiality, integrity, and availability. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that could facilitate lateral movement, data theft, or the installation of persistent backdoors within the organization's infrastructure.

Immediate Action: Update Raytha CMS to version 1.4.6 or later immediately to incorporate the necessary sandboxing and access restrictions.

Proactive Monitoring: Review application logs for suspicious activity within the Functions module or unusual execution patterns originating from administrative accounts.

Compensating Controls: Implement strict role-based access control to limit the number of users with administrative privileges, and ensure the application is running with the principle of least privilege regarding file system and network access.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Raytha CMS must treat this vulnerability with high priority due to the potential for full server compromise. Administrators should verify their current deployment version and apply the 1.4.6 update as soon as possible to mitigate the risk of malicious code execution by unauthorized or compromised privileged accounts.