ImpressCMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/impresscms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 14 Aug 2026 20:13:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthenticated RCE in ImpressCMS Custom Tag Modulehttps://feed.craftedsignal.io/briefs/2026-08-impresscms-rce/Fri, 14 Aug 2026 20:13:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-impresscms-rce/ImpressCMS contains an authenticated remote code execution vulnerability (CVE-2026-73679) in the custom tag module, allowing administrators to execute arbitrary PHP code via improperly sanitized input.ImpressCMS is susceptible to a remote code execution vulnerability (CVE-2026-73679) within its custom tag module. The vulnerability allows an authenticated administrator to inject arbitrary PHP code by creating a custom tag with the PHP type enabled. The application's renderWithPhp() method processes these tags by calling the undoHtmlSpecialChars() function, which decodes HTML-encoded content before passing it directly to the PHP eval() function. This process bypasses the HTML Purifier sanitization layer that is intended to secure user-provided content. Because these tags are processed through the system's preload event mechanism, the injected payload executes automatically on every frontend page load, providing the attacker with persistent command execution within the application context.

Impact

Successful exploitation of this vulnerability allows an authenticated administrative user to achieve full code execution on the underlying web server. This can lead to total system compromise, including unauthorized data access, modification of site content, and potential lateral movement within the hosting infrastructure.

Recommendation

  1. Patch ImpressCMS to the latest version as soon as the vendor releases a fix for CVE-2026-73679.
  2. Audit current administrator user accounts for signs of unauthorized access or activity.
  3. Review the custom tag module configuration for any tags with the 'PHP' type enabled that were not explicitly created by authorized personnel.
  4. Deploy web application firewall (WAF) rules to monitor and block requests that attempt to pass malicious PHP payloads into the custom tag creation or modification endpoints.
]]>highadvisory