Authenticated RCE in ImpressCMS Custom Tag Module

ImpressCMS is susceptible to a remote code execution vulnerability (CVE-2026-73679) within its custom tag module. The vulnerability allows an authenticated administrator to inject arbitrary PHP code by creating a custom tag with the PHP type enabled. The application's renderWithPhp() method processes these tags by calling the undoHtmlSpecialChars() function, which decodes HTML-encoded content before passing it directly to the PHP eval() function. This process bypasses the HTML Purifier sanitization layer that is intended to secure user-provided content. Because these tags are processed through the system's preload event mechanism, the injected payload executes automatically on every frontend page load, providing the attacker with persistent command execution within the application context.

Impact

Successful exploitation of this vulnerability allows an authenticated administrative user to achieve full code execution on the underlying web server. This can lead to total system compromise, including unauthorized data access, modification of site content, and potential lateral movement within the hosting infrastructure.

Recommendation

1. Patch ImpressCMS to the latest version as soon as the vendor releases a fix for CVE-2026-73679.
2. Audit current administrator user accounts for signs of unauthorized access or activity.
3. Review the custom tag module configuration for any tags with the 'PHP' type enabled that were not explicitly created by authorized personnel.
4. Deploy web application firewall (WAF) rules to monitor and block requests that attempt to pass malicious PHP payloads into the custom tag creation or modification endpoints.