phpKF CMS 3.00 Beta y6 contains a critical unauthenticated file upload vulnerability (CVE-2021-47753) that allows remote attackers to execute arbitrary code. The vulnerability enables attackers to bypass file extension checks by uploading PHP files disguised as PNG files, then renaming and executing them as web shells. This provides complete system command execution capabilities to unauthenticated remote attackers. The vulnerability affects the phpKF Content Management System and has been documented with proof-of-concept exploits available on Exploit-DB.