A critical remote code execution vulnerability in Aetopia Digital Asset Management allows unauthenticated attackers to compromise the entire system.

The application is susceptible to server-side template injection within the name and description parameters of the Add/Update Project function, which can be triggered by an unauthenticated remote attacker.

Successful exploitation grants an attacker full control over the affected application, potentially leading to total system compromise, data theft, and loss of intellectual property stored within the Digital Asset Management system. Given the CVSS score of 9.8, this vulnerability represents a maximum risk to organizational security and business continuity.

Immediate Action: Contact Aetopia support immediately to inquire about a security patch for version 1.0.0, as no public fix is currently confirmed.

Proactive Monitoring: Review application and server logs for suspicious activity involving the Add/Update Project function, specifically looking for unusual strings or injection patterns in name or description fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block malicious payloads targeting template injection patterns in project management parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's technical write-up at eslam3kl.gitbook.io.

This vulnerability presents an extreme risk due to the potential for full remote code execution without the need for authentication. Security teams should prioritize isolating affected Aetopia DAM instances from public-facing networks until a vendor-supplied patch is applied. Immediate verification of system logs for signs of prior compromise is strongly advised.