Executive brief
Yot CMS, a web content management system, includes an admin console feature that directly executes arbitrary PHP code submitted by administrators without validation or filtering. An attacker who gains admin-level access (through legitimate credentials or other vulnerabilities in the application) can execute arbitrary code on the web server, leading to complete system compromise. This effectively gives attackers a built-in backdoor once admin privileges are obtained.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the Admin Console component of Yot CMS. The vulnerable code path begins at index.php, which routes HTTP requests with page=console and file=admin to the console admin handler. The modsys/console/admin.php file unsafely executes eval($_POST['text']) without any validation, filtering, sandboxing, or CSRF protection on user-supplied input. An attacker must first achieve an authenticated session with admin level 3 or higher; however, the advisory notes that other unauthenticated privilege escalation paths exist in the same codebase that could be chained to reach this point. Once authenticated, the attacker can POST arbitrary PHP code to /index.php?page=console&file=admin and achieve remote code execution in the web server process context. No patches are explicitly mentioned in the advisory.
Affected products
- Yot CMS up to 3.3.1
Timeline
- 2026-09-14: disclosed: CVE published and proof-of-concept disclosed publicly
- 2026-09-14: other: Reported as publicly disclosed and may be used in the wild