A code injection issue in the /type.php file allows attackers to execute arbitrary code by writing PHP code to a cache file with a controllable filename. The PHP code is sent via the `template` parameter and is written to a data/cache template/*.tpl.php file, which includes a "<?php function " substring.