Read the docs
TI-2026-51758 Aliases CVE-2026-73679GHSA-j4fh-vmxm-5699

ImpressCMS Authenticated RCE via PHP Custom Tag eval()

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01126 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ImpressCMSImpressCMSup to 2.0.3—No fix listedCNA
  • ImpressCMS VendorImpressCMS Affected up to 2.0.3 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73679
  2. 2026-10-03 Alias added: GHSA-j4fh-vmxm-5699

References

Other 2

  • TI-2022-26365 ImpressCMS 1.4.4 - Unrestricted File Upload CVSS 4.0CRITICAL 9.3
  • TI-2021-22551 ImpressCMS 1.4.2 Remote Code Execution via Autotasks CVSS 4.0HIGH 8.7
  • TI-2019-15755 ImpressCMS 1.3.11 SQL Injection via bid Parameter CVSS 4.0HIGH 7.1
  • TI-2021-08319 ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. CVSS 3.1CRITICAL 9.8
  • TI-2023-19270 A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows… CVSS 3.1MEDIUM 4.8
  • TI-2022-08771 ImpressCMS before 1.4.2 allows unauthenticated remote code execution via .....///… CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences