{"id":"CVE-2026-71232","aliases":["EUVD-2026-53305","GHSA-cv48-22qx-mpmx"],"status":"published","title":"MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0054,"percentile":0.45875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-08-05T10:56:15Z","modified":"2026-10-28T02:30:26Z","products":[{"vendor":"magicblack","product":"maccms10"}],"references":[{"url":"https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71232","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cv48-22qx-mpmx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71232.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71232","title":"MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.","status":"published","published":"2026-08-05T10:56:15.883Z","modified":"2026-08-10T11:45:29.873Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53305","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.","status":"published","published":"2026-08-05T10:56:15Z","modified":"2026-08-10T11:45:29Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-cv48-22qx-mpmx","title":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP...","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (\u003c?php if(condition): ?\u003e), an authenticated administrator could inject a payload such as {if condition=\"exec('id \u003e /tmp/pwned.txt')\"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter.","status":"published","published":"2026-08-05T12:31:30Z","modified":"2026-08-05T12:31:31Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71232","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.","status":"published","published":"2026-08-05T11:16:25.873Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71232","title":"MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE","description":"MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.","status":"published","published":"2026-08-05T10:56:15.883Z","modified":"2026-10-28T02:30:26.264819349Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:15.164658Z"}]}}