Quick answers
- Is CVE-2026-73679 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73679 being exploited in the wild.
- How severe is CVE-2026-73679?
- High severity, with a CVSS score of 7.2, published 14 August 2026.
- Which products and versions are affected?
- Impresscms 2.0.3 and earlier.
- Is there a fix for CVE-2026-73679?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-73679 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-73679?
- Check whether you run Impresscms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a PHP code injection vulnerability in the custom tag module affecting ImpressCMS 2.0.3 and earlier. The vulnerable renderWithPhp() method in htdocs/modules/system/admin/customtag/class/customtag.php passes custom tag content to PHP's eval() function. Although HTML Purifier sanitizes the input, the undoHtmlSpecialChars() function decodes HTML entities back to plain characters before eval() executes, bypassing the sanitization. An authenticated administrator can create a PHP-type custom tag (customtag_type=3) containing malicious code, which is then stored in the database and executed on every frontend page load via the preload event system. No user interaction is required beyond administrator account access. Patches are available in versions after 2.0.3.
Affected products
- ImpressCMS ImpressCMS 2.0.3 and earlier
Timeline
- 2026-08-14: disclosed