TI-2026-61695 Aliases CVE-2026-90788 GHSA-ffxm-fmch-m6mq

magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

MEDIUM 56CWE-77Published 2026-09-14 · Updated 2026-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02184 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
magicblack	MacCMS10	2026.1000.4055	—	No fix listed	CNA

MacCMS10 Vendormagicblack Affected 2026.1000.4055 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:magicblack:maccms10::::::::	—	—	magicblack

cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:* Versions — — ·magicblack

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-90788
2026-10-03 Alias added: GHSA-ffxm-fmch-m6mq

References

Exploit 1

https://github.com/magicblack/maccms10/issues/1378

Other 1

https://github.com/magicblack/maccms10/

TI-2026-75090 Password recovery brute-force in MacCMS allows account takeover CVSS 4.0CRITICAL 9.1
TI-2026-80388 Password recovery flaw in MacCMS v10 allows account takeover CVSS 4.0CRITICAL 9.3
TI-2026-80390 Mass assignment in MacCMS lets anonymous comments impersonate users CVSS 4.0MEDIUM 6.9
TI-2026-49903 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE CVSS 3.1HIGH 7.2
TI-2026-80389 Race condition in MacCMS lets members reuse recharge cards CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences