Quick answers
- Is CVE-2026-90709 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90709 being exploited in the wild.
- How severe is CVE-2026-90709?
- Medium severity, with a CVSS score of 4.7, published 14 September 2026.
- Which products and versions are affected?
- Yot CMS up to 3.3.1.
- Is there a fix for CVE-2026-90709?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90709 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-90709?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the Admin Console component of Yot CMS. The vulnerable code path begins at index.php, which routes HTTP requests with page=console and file=admin to the console admin handler. The modsys/console/admin.php file unsafely executes eval($_POST['text']) without any validation, filtering, sandboxing, or CSRF protection on user-supplied input. An attacker must first achieve an authenticated session with admin level 3 or higher; however, the advisory notes that other unauthenticated privilege escalation paths exist in the same codebase that could be chained to reach this point. Once authenticated, the attacker can POST arbitrary PHP code to /index.php?page=console&file=admin and achieve remote code execution in the web server process context. No patches are explicitly mentioned in the advisory.
Affected products
- Yot CMS up to 3.3.1
Timeline
- 2026-09-14: disclosed: CVE published and proof-of-concept disclosed publicly
- 2026-09-14: other: Reported as publicly disclosed and may be used in the wild