Executive brief
mtrano APENCMS is a content management system that uses a template engine to dynamically generate web pages. An attacker can inject malicious code through the site configuration parameter, allowing remote execution of arbitrary commands and potential complete system compromise.
Technical details
The vulnerability exists in the eval function within cms/weasel.php (Template Engine component), where the $_CMS['site'] parameter is not properly sanitized before use. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary PHP code, leading to code execution. The vulnerability has been publicly disclosed and a proof-of-concept exploit is available.
Affected products
- mtrano APENCMS up to commit 6546096d354153309693efabb9a0d824628ed4f5
Timeline
- 2026-09-22: disclosed