CVE-2026-95501 in APENCMS
Summary
by MITRE • 09/22/2026
A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified vulnerability resides within the APENCMS content management system, specifically affecting versions up to commit 6546096d354153309693efabb9a0d824628ed4f5. The core of the issue is located in the file cms/weasel.php, which serves as a critical component within the system's Template Engine architecture. This module is responsible for processing and rendering dynamic content based on user inputs or configuration parameters. Due to the rolling release nature of APENCMS, precise version numbers are not explicitly disclosed by the vendor, making it necessary for administrators to assess their deployment against the specified commit hash to determine exposure status. The lack of response from the vendor upon notification further complicates remediation efforts, leaving system operators with limited official guidance on patching strategies.
The technical flaw is classified as a Remote Code Execution vulnerability resulting from improper neutralization of special elements used in an OS command or code injection context. Specifically, the function eval within cms/weasel.php fails to adequately sanitize the input received via the $_CMS['site'] argument. This variable typically holds configuration data related to site settings, but when processed by the eval function without rigorous validation, it allows for arbitrary PHP code execution. The vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), as the application constructs and executes code using user-supplied input in a manner that permits an attacker to inject malicious payloads. This is further categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically PHP scripting, which describes how attackers use system interpreters to execute commands on compromised hosts.
The operational impact of this vulnerability is severe due to its remote exploitability. An unauthenticated or authenticated attacker can send specially crafted HTTP requests targeting the affected endpoint with maliciously constructed values for the site parameter. Upon processing, the eval function executes the injected code within the context of the web server process. This grants the attacker full control over the underlying system, potentially leading to complete compromise of the APENCMS installation. Consequences include unauthorized access to sensitive data stored in the database, modification or deletion of website content, and using the compromised server as a pivot point for further attacks against internal network resources. The fact that public exploits are available significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts across the internet.
Mitigation strategies must be implemented immediately given the absence of vendor patches. Administrators should first assess whether their instance corresponds to the vulnerable commit range by checking version control logs or build artifacts if accessible. In the interim, network-level controls such as Web Application Firewalls can be configured to detect and block patterns associated with PHP code injection attempts targeting the weasel.php endpoint. Input validation must also be enforced at the application level; developers should replace direct eval calls with safer alternatives like include_once for template loading or implement strict allowlists for permitted values in the site configuration parameter. If immediate patching is not feasible, restricting access to the affected administrative interfaces via IP whitelisting can reduce exposure until a secure version of APENCMS is identified and deployed through alternative channels since the vendor remains unresponsive.