{"id":"CVE-2026-73679","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-73679","generatedAt":"2026-10-28T07:03:51.112Z","title":"ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled.","description":"ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.","published":"2026-08-14T19:18:02.000Z","lastModified":"2026-08-26T16:57:52.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.6,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-94"],"affected":[],"epss":{"score":0.01126,"percentile":0.66125,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/DevVaibhav07/VULN-POC/blob/main/ImpressCMSRCCE.md","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ImpressCMS/impresscms","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/impresscms-authenticated-rce-via-php-custom-tag-eval","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-73679","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}