TallCMS CVE-2026-105329

Requires (1) an authenticated TallCMS admin-panel account at a privilege level below super_admin, and (2) the plugin-upload capability to be enabled (the uploadsAllowed() config flag must be true). Pre-patch, the PluginManager Livewire component methods (install and applyUpdate/runMigrations) enforced only client-side/UI visibility checks and lacked server-side super_admin authorization, so a lower-privileged panel user could invoke them directly to push a plugin ZIP of arbitrary PHP. Limiting factors that reduce real-world exploitability: valid authentication is mandatory (not internet-anonymous), the uploads feature must be turned on, and only TallCMS ≤4.8.0 is affected; the fix adds auth()->user()->hasRole('super_admin') server-side guards.

Signals are mixed and partly contradictory. The vendor/VulDB CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) with E:P yields only 5.3 (medium), but that score rests on LOW impact ratings (VC:L/VI:L/VA:L) that appear to understate reality - the source-code patch confirms the flaw lets an authenticated non-super-admin install/update plugins, and the maintainers' own commit comments state uploaded ZIPs 'contain arbitrary PHP that gets autoloaded and executed.' That is effectively authenticated remote code execution (CWE-94), which warrants HIGH confidentiality/integrity/availability impact, not LOW - so the published 5.3 likely undervalues the technical impact. Mitigating the risk: exploitation is NOT unauthenticated - the CVSS vector's PR:L means an attacker needs a valid lower-privileged TallCMS panel account, and the plugin-upload feature (uploadsAllowed flag) must be enabled. Publicly available exploit code exists (GitHub issue #122 referenced as 'exploit'), raising practical risk, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided, so there is no evidence of in-the-wild or widespread exploitation. Net: a genuine privilege-boundary/RCE bug worth patching promptly for anyone running TallCMS ≤4.8.0 with plugin uploads enabled, but the low real-world footprint of the product and the authentication requirement keep aggregate internet-wide risk modest. EPSS is missing and SSVC was not supplied - automatability and exploitation maturity beyond 'PoC' cannot be confirmed from the input.

An attacker who holds a low-privileged TallCMS Filament admin-panel account (not super_admin) navigates to the Plugin Manager and uploads a crafted plugin ZIP containing malicious PHP, or directly invokes the unprotected Livewire install/applyUpdate methods; the uploaded code is autoloaded and executed on the server, yielding remote code execution. Pre-patch the install/update actions lacked server-side super_admin role checks, so the UI-level gating could be bypassed by calling the component methods directly. A public proof-of-concept is referenced (GitHub issue #122).