Executive brief
InstantCMS is an open-source content management system used to build and manage websites. The component installer feature contains a flaw that allows authenticated administrators to upload and execute arbitrary PHP code on the server by crafting a malicious package with a custom .htaccess file. An attacker with admin access can gain full control over the application and underlying server.
Technical details
The vulnerability is a code injection issue in InstantCMS's package installer component. Although uploaded PHP files in the upload folder are normally not executed, an attacker can bypass this protection by uploading a custom .htaccess file that enables PHP execution in the upload directory. The vulnerability requires authenticated access with administrative privileges. An attacker can craft a malicious ZIP package containing a .htaccess file (to enable PHP execution) and PHP files (to execute arbitrary code), upload it via the installer, and then directly request the PHP file to achieve remote code execution. Version 2.18.2 and later contain the fix, which implements multiple security measures including validation of uploaded packages, restrictions on .htaccess files, and secure temporary directory handling.
Affected products
- InstantCMS InstantCMS prior to 2.18.2
Timeline
- 2026-06-07: disclosed
- 2026-09-08: advisory
- 2026-05-31: patched: Fix committed prior to public disclosure