Summary An unsafe PHP code injection vulnerability in the Studio Dropdown Editor allows any administrator to achieve persistent OS-level code execution as www-data. The $dropdown_name parameter is passed through html_entity_decode() and written verbatim into a PHP language file that is include()d on every subsequent page load, creating a persistent server-side webshell. Impact Any attacker who has gained administrator credentials can achieve persistent, unauthenticated OS-level code execution as www-data on the server. The injected webshell survives reboots and cache clears because it is written to a source file under custom/. Full confidentiality, integrity, and availability of both the application and the underlying host are compromised.