CVE-2026-73679 ImpressCMS Authenticated RCE via PHP Custom Tag eval()
Authenticated administrators can execute arbitrary PHP code in ImpressCMS by injecting malicious payloads into custom tags, bypassing sanitization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73679?
CVE-2026-73679 is a high-severity code injection vulnerability in ImpressCMS, published on 14 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.
Weakness: CWE-94
Which versions are affected by CVE-2026-73679?
How do I fix CVE-2026-73679?
No fix has been published for CVE-2026-73679 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73679 being exploited?
There is no known exploitation of CVE-2026-73679 in the wild and no public exploit code.
Sources
Also known as GHSA-j4fh-vmxm-5699.