# CVE-2026-36239: PbootCMS code injection in site configuration functionality

Source: https://junglewise.ai/threats/cve-2026-36239-pbootcms-code-injection-in-site-configuration-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-36239 · Severity: info · CVSS 7.2 · Published 2026-05-26

PbootCMS, a popular PHP-based content management system, contains a security flaw in its site configuration settings. An attacker with administrative access can inject malicious code into the website's footer information field. When the website is viewed by any user, this code executes on the server, potentially allowing the attacker to take full control of the website, steal data, or disrupt operations.

Technologies: [PbootCMS](https://junglewise.ai/threats/technologies/pbootcms). Vendors: [PbootCMS](https://junglewise.ai/threats/vendors/pbootcms).

## Quick answers

**Is CVE-2026-36239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36239 being exploited in the wild.

**How severe is CVE-2026-36239?** Informational severity, with a CVSS score of 7.2, published 26 May 2026.

**Which products and versions are affected?** PbootCMS <= 3.2.12.

**Is there a fix for CVE-2026-36239?** A patch was published on 2025-04-22: Version 3.2.11 released (though vulnerability persists in 3.2.12) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-36239 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-36239?** Check whether you run PbootCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in PbootCMS versions up to and including 3.2.12 due to insufficient sanitization of the 'Footer Information' (sitecopyright) field in the administrative backend. The root cause is located in the decode_string() function within /apps/home/controller/ParserController.php, where the sequential use of stripcslashes() and htmlspecialchars_decode() on user-supplied input allows executable PHP code to be restored and rendered. An authenticated attacker can inject a PHP payload into the site configuration, clear the template cache, and trigger execution by visiting any frontend page that utilizes the {pboot:sitecopyright} template tag. This can result in a full system compromise and the deployment of web shells.

## Affected products

- PbootCMS PbootCMS <= 3.2.12

## Timeline

- 2025-04-22: patched: Version 3.2.11 released (though vulnerability persists in 3.2.12)
- 2026-05-26: disclosed: CVE published

## References

- [http://hunan.com/](http://hunan.com/)
- [http://pbootcms.com/](http://pbootcms.com/)
- [https://github.com/TazmiDev/CVE-2026-36239](https://github.com/TazmiDev/CVE-2026-36239)

## Related threats

- [PbootCMS cross-site request forgery in user management](https://junglewise.ai/threats/cve-2026-92383-pbootcms-cross-site-request-forgery-in-user-management)
- [PbootCMS stored XSS in template rendering via decoded title field](https://junglewise.ai/threats/cve-2026-92381-pbootcms-stored-xss-in-template-rendering-via-decoded-title-field)
- [PbootCMS SQL injection in user management module](https://junglewise.ai/threats/cve-2026-79387-pbootcms-sql-injection-in-user-management-module)
- [PbootCMS remote code execution in controller files](https://junglewise.ai/threats/cve-2026-67960-pbootcms-remote-code-execution-in-controller-files)
- [PbootCMS weak password recovery in MemberController](https://junglewise.ai/threats/cve-2026-12066-pbootcms-weak-password-recovery-in-membercontroller)