Which versions of PHP are affected by CVE-2026-5041?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-5041, a command injection vulnerability rated CVSS 5.1.

Is there a public PoC exploit available for CVE-2026-5041?

Yes, a public proof-of-concept exploit is available for CVE-2026-5041. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-5041?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-5041

Q: What is the CVSS score of CVE-2026-5041?

CVE-2026-5041 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-16985 LOW

Command Injection (CWE-77)

2026-03-29 VulDB

GHSA-j9px-j4m5-375m

PHP Command Injection Chamber Of Commerce Membership Management System Code Projects

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 10:00 euvd

EUVD-2026-16985

Analysis Generated

Mar 29, 2026 - 10:00 vuln.today

CVE Published

Mar 29, 2026 - 09:45 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the function fwrite of the file admin/pageMail.php. The manipulation of the argument mailSubject/mailMessage leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.

Technical ContextAI

The vulnerability exists in the PHP file admin/pageMail.php, where user-supplied input from the mailSubject and mailMessage parameters is passed unsanitized to the fwrite function, enabling command injection attacks. This is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command-'Command Injection'), a weakness that arises when application code constructs and executes system commands without properly escaping or validating user input. The affected product is the Chamber of Commerce Membership Management System version 1.0, developed by code-projects, as identified by CPE cpe:2.3:a:code-projects:chamber_of_commerce_membership_management_system. The root cause is insufficient input validation and sanitization before passing untrusted data to functions capable of executing system commands or writing to critical PHP files that could be executed.

RemediationAI

Upgrade the Chamber of Commerce Membership Management System to a patched version released by code-projects to address the command injection vulnerability in admin/pageMail.php. If a specific patched version is not yet available, immediately implement strict input validation and sanitization on all user-supplied parameters (mailSubject, mailMessage) before they are passed to fwrite or any command execution function; use allowlists for acceptable characters and employ parameterized or escaped command construction. Restrict administrative access to the mail configuration functionality to only fully trusted administrators, and consider disabling the mail configuration feature if not essential. Review server logs and file write events for the admin/pageMail.php endpoint to detect any prior exploitation attempts. Consult the vendor advisory at https://vuldb.com/vuln/353964 for vendor-specific remediation guidance.