Executive brief
MacCMS10 is an open-source PHP-based content management system used to host video, article, and media content. A template injection vulnerability in the admin interface allows authenticated attackers to execute arbitrary system commands on the server, potentially leading to complete system compromise and data theft.
Technical details
The vulnerability is a template injection flaw in the Template Handler component, specifically in the /admin1.php/admin/template/index/path/ endpoint. An authenticated admin attacker can craft a malicious template file containing embedded PHP expressions (e.g., {define name="x" value=":array_map('sy'.'stem',array('whoami'))" /}) that are evaluated server-side when the template is processed. The attack requires admin panel access to upload or manipulate template files, but once a malicious template is saved, accessing the template through the frontend (e.g., /index.php/label/123.html) triggers code execution. A patch or fix status from the vendor has not been confirmed.
Affected products
- magicblack MacCMS10 2026.1000.4055
Timeline
- 2026-09-14: disclosed: CVE-2026-90788 published