A vulnerability in the fastCMS PluginController component allows local attackers to achieve arbitrary code execution, posing a significant risk to system integrity.

This vulnerability is a local arbitrary code execution flaw residing in the PluginController.java component, which can be exploited by an attacker with local access to the system.

The ability for a local attacker to execute arbitrary code represents a total compromise of the affected host. Given the CVSS score of 7.8, this vulnerability carries a high severity rating because it permits unauthorized control over the system, potentially leading to data exfiltration, lateral movement, or complete service disruption.

Immediate Action: Update fastCMS to version 0.1.6 or later to incorporate the necessary security patches.

Proactive Monitoring: Audit local system logs for unauthorized executions or suspicious activity originating from the PluginController component.

Compensating Controls: Restrict local user access and enforce the principle of least privilege to ensure that non-administrative users cannot interact with sensitive application components.

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the researcher write-up at github.com/sorzs/test/tree/main/fastcms-rce).

The severity of this flaw necessitates immediate attention, as it allows for full control of the application server by a local user. Organizations should prioritize updating to version 0.1.6 immediately to eliminate the risk of arbitrary code execution.