CVE-2026-73679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73679
Published
2026-08-14T19:03:24.913Z
Modified
2026-08-19T03:31:06.171224305Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ImpressCMS Authenticated RCE via PHP Custom Tag eval()
Details

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73679.json"
}
References

Affected packages

Git / github.com/impresscms/impresscms

Affected ranges

Type
GIT
Repo
https://github.com/impresscms/impresscms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5fbdbc9e44e0b60fd9f2afbe1f8ca2cf69ee9621
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.3.10-beta
1.3.8
1.3.9
1.3.9_rc
impresscms_1.*
impresscms_1.3.3
impresscms_1.3.4
v1.*
v1.3.10
v1.3.11
v1.3.11-beta
v1.3.11-beta2
v1.3.11-rc
v1.3.11-rc2
v1.3.8
v1.4.0
v1.4.0-alpha
v1.4.0-alpha.2
v1.4.0-beta
v1.4.0-rc
v1.4.2
v1.4.2_bis
v1.4.2_rc
v1.4.3
v1.4.3-rc
v1.4.3-rc2
v1.4.4
v1.5.0-beta
v1.5.0-rc
v2.*
v2.0.0
v2.0.0_beta_1
v2.0.0_beta_3
v2.0.0_rc
v2.0.1
v2.0.2
v2.0.2_beta
v2.0.2_rc
v2.0.3
v2.0.3_beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73679.json"