Authenticated code execution via unrestricted template file overwrite

Arbitrary file write in BeeCMS 4.0 allows remote authenticated users to execute code by overwriting an existing PHP file. The save_template branch in admin_template.php joins the user-controlled file value to CMS_PATH, checks only that the path exists, opens it with w+, and writes supplied template content without path isolation or suffix validation. Access requires the tpl_manage permission in the administrative template editor, and successful use replaces an existing server-side file with attacker-controlled PHP that executes when requested.