CVE-2026-73679 in ImpressCMS
Summary
by MITRE • 08/14/2026
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the ImpressCMS content management system where an authenticated administrator can achieve remote code execution through a flaw in the custom tag module functionality. The technical implementation allows attackers to store malicious PHP payloads within custom tags that have PHP type enabled, creating a persistent backdoor for code execution. The core issue stems from improper input validation and sanitization processes within the application's rendering pipeline.
The vulnerability exploits a critical flaw in how the system handles HTML-encoded content by utilizing the undoHtmlSpecialChars() function which reverses HTML encoding before passing data to the eval() function in renderWithPhp() method. This specific bypass of HTML Purifier sanitization mechanisms creates an execution path where malicious code can be stored and executed without proper validation checks. The vulnerability is particularly dangerous because it operates at the core rendering layer of the application, allowing arbitrary PHP code execution with administrator privileges.
The operational impact of this vulnerability extends beyond simple code execution as it provides attackers with complete control over the affected system. Every frontend page load triggers the malicious payload through the preload event system, ensuring persistent execution without requiring additional user interaction or specific conditions. This characteristic transforms what could be a one-time exploitation into a continuous threat that operates silently in the background during normal application usage.
Security practitioners should implement multiple layers of mitigation including strict input validation, disabling PHP type functionality for custom tags when not essential, and implementing proper privilege separation between administrative functions and code execution capabilities. The vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and represents a direct violation of secure coding practices that prevent dynamic code evaluation from untrusted sources. Organizations should also consider implementing web application firewalls to detect and block suspicious payload patterns, while monitoring for unusual administrative activities that might indicate exploitation attempts.
The ATT&CK framework categorizes this vulnerability under T1059.007 (Command and Scripting Interpreter: PHP) and T1566 (Phishing), as it enables attackers to establish persistent command execution capabilities through legitimate administrative interfaces. Immediate remediation includes disabling the affected module functionality, applying official patches if available, and implementing comprehensive monitoring of administrative activities. Organizations should also conduct thorough security assessments to identify other potential code injection vulnerabilities within their custom modules that might share similar architectural flaws in input handling and sanitization processes.