Summary by metantz
An unauthenticated stack buffer overflow in PSG's native continuum module: the <SURFACE-TYPE> value from the public API is copied by unbounded strncpy into 50-byte stack buffers, overflowing into the adjacent filelog path buffer. By ending the copy at the original path's NUL terminator, an attacker controls both the file path and the appended content (<SURFACE-SURF>, written verbatim with no check on flog), turning the overflow into a silent arbitrary file write. Pointing it at the web-executable, runtime-writable graphs/ web root allows a single anonymous POST to drop a persistent PHP web shell — unauthenticated remote code execution as the web-server user, with no crash and an empty session log. Root cause: missing length/charset validation on the token, plus the unchecked flog before fprintf.