Nakid CMS is vulnerable to a remote arbitrary file upload vulnerability due to improper validation of user-supplied input. An attacker can exploit this vulnerability by uploading malicious files to the server, which can be used to execute arbitrary code on the server. The vulnerability exists in the 'config.php' file, which is located in the 'includes/js/fckeditor/editor/filemanager/connectors/php/' directory. The 'config.php' file contains the following code: '$Config['Enabled'] = true ;' and '$Config['UserFilesPath'] = '/nakid_uploads/' ;'. This allows an attacker to upload arbitrary files to the server, which can be used to execute arbitrary code.