Read the docs
TI-2026-39443 Aliases CVE-2026-54611

InstantCMS has Remote Code Execution in package installer

Priority MEDIUM 58CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00663 51st percentileScored 2026-11-07
Fix Fixed icms2 (instantsoft): 2.18.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
instantsofticms2before 2.18.22.18.2Patch availableCNA
  • icms2 Vendorinstantsoft Affected before 2.18.2 Fixed in 2.18.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*——InstantCMS
  • cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:* Versions — — ·InstantCMS

Remediation

  • Fix · CNA icms2 (instantsoft) Fixed in 2.18.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54611
  2. 2026-10-06 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2023-03877 SQL Injection in instantsoft/icms2 CVSS 3.1CRITICAL 9.1
  • TI-2024-20589 SQL injection in index_chart_data action CVSS 3.1HIGH 7.2
  • TI-2023-04538 SQL Injection in instantsoft/icms2 CVSS 3.1HIGH 7.2
  • TI-2025-36697 InstantCMS vulnerable to Server-Side Request Forgery via package installer CVSS 3.1HIGH 7.2
  • TI-2023-04291 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 CVSS 3.1MEDIUM 6.1
  • TI-2024-33783 InstantCMS has a Cross Site Scripting Vulnerability CVSS 3.1MEDIUM 5.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences