Server command execution via unvalidated thumbnails

Improper thumbnail validation in Yoga Class Registration System 1.0 allows administrators to execute commands on the server. The CVE record does not identify the upload handler, accepted file properties, or command-execution path; the CNA advisory instead documents a CSRF request to Users.php?f=save that creates an administrator account. The recorded command-execution path requires administrative access, while the advisory proof requires an authenticated administrator to visit attacker-controlled content.