CVE-2026-105156 in YzmCMS
Summary
by MITRE • 10/04/2026
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/04/2026
The identified vulnerability resides within YzmCMS versions up to 7.6 and specifically affects the Password function located in the /common/function/system.func.php file of the MD5 Handler component. This flaw is categorized as a weakness related to insufficient computational effort when generating password hashes, which aligns with CWE-916: Production Use of Weak Cryptography. The core technical issue stems from the use of the MD5 hashing algorithm for storing user credentials. MD5 is widely recognized in the cybersecurity community as cryptographically broken and unsuitable for further use due to its speed and susceptibility to collision attacks, making it vulnerable to brute-force and rainbow table attacks. When an attacker manipulates the pass argument passed to this function, they can exploit the lack of salting or key stretching mechanisms inherent in standard MD5 implementations, resulting in password hashes that are computationally inexpensive to reverse.
From a threat modeling perspective, this vulnerability allows for remote exploitation with high complexity and difficult exploitability. The classification under MITRE ATT&CK Technique T1110: Brute Force is appropriate here, as the primary attack vector involves attempting to recover plaintext passwords from their hashed representations through exhaustive guessing or precomputed lookup tables. Although the exploit requires significant effort due to the complexity of bypassing potential application-level controls or network security measures, the availability of public exploits increases the risk landscape significantly. Attackers with moderate skills can leverage these tools to compromise user accounts if the underlying password storage mechanism remains weak. The operational impact includes unauthorized access to administrative panels and user data, potentially leading to further system compromise, data exfiltration, or defacement depending on the privileges associated with the compromised account.
The vendor has acknowledged the severity of this issue within their development lifecycle. They have indicated that their regular release cycle spans approximately six months, with the last update released in the previous month and the next scheduled version set for March 2027. This timeline suggests a prolonged period during which existing deployments remain exposed to this cryptographic weakness unless interim mitigations are applied. The vendor plans to implement a backward-compatible gradual hash migration feature in their upcoming release, likely transitioning from MD5 to a more robust algorithm such as bcrypt, Argon2, or PBKDF2 with appropriate salt and iteration counts. This approach aims to ensure that existing users can upgrade without breaking functionality while improving the security posture of stored credentials over time.
In the interim period before the official patch is released, organizations running YzmCMS must implement defensive mitigations to reduce risk. Security teams should review their deployment configurations for any custom overrides or patches that might enforce stronger hashing algorithms if possible within the framework's constraints. Additionally, implementing multi-factor authentication can significantly mitigate the impact of password hash compromise by adding a second layer of verification independent of the stored credential strength. Network-level controls such as rate limiting on login endpoints and IP-based access restrictions should be enforced to slow down brute-force attempts. Monitoring logs for unusual authentication patterns is also critical for early detection of exploitation activities. Organizations must treat this vulnerability with high priority due to the public availability of exploits, even though the exploitability is considered difficult, as automated tools can lower the barrier to entry for attackers targeting widespread deployments of YzmCMS.