EUVD-2026-39795
GHSA-rc6m-346q-rgq6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with 'user: manage users' account
-
DeliveryPOST to UserApiController::saveAction()
-
ExploitSelf-assign role with 'system: manage packages'
-
ExecutionUpload malicious PHP package via admin installer
-
PersistInstall package to execute code
-
ImpactRemote code execution on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Pagekit CMS 1.0.18 account that already holds the 'user: manage users' permission (PR:L), and a custom role carrying 'system: manage packages' must exist or be creatable for self-assignment; the final RCE step depends on the admin package installer being available to install attacker-supplied PHP packages. No user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N). Limiting factors: it is NOT unauthenticated - an attacker without the 'user: manage users' delegated permission cannot start the chain - and deployments that confine user-management strictly to trusted full administrators, or that disable the package installer, substantially blunt the attack. |
| Impact | The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an existing authenticated account with 'user: manage users'), no user interaction, and full confidentiality/integrity/availability impact via RCE. PR:L is the key tempering factor - this is not an unauthenticated flaw; an attacker must already possess a delegated user-management role, which is a meaningful but not exotic prerequisite in multi-admin deployments. Publicly available exploit code raises practical risk and lowers the barrier to weaponization, but no EPSS score and no KEV listing were provided, so widespread or active exploitation cannot be asserted. There is no SSVC decision data in the input. Net: a credible, high-impact escalation chain that is a real priority for any multi-user Pagekit instance, though the PR:L gate keeps it below the urgency of an unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker controlling a low-trust Pagekit account that was delegated the 'user: manage users' permission (e.g., a support or content-team operator) issues an API request to UserApiController::saveAction() assigning their own account a custom role that includes 'system: manage packages'. With that elevated capability, they upload a crafted PHP package through the admin package installer, which executes on installation to yield remote code execution on the server. Publicly available exploit code (sermikr0 gist) demonstrates the chain, making low-effort reproduction realistic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Privilege escalation to remote code execution in Pagekit CMS 1.0.18 lets an authenticated user holding the 'user: manage users' permission grant themselves arbitrary custom roles via an unprotected UserApiController::saveAction(), then assign a role carrying 'system: manage packages' to upload a malicious PHP package through the admin installer and run arbitrary code. Publicly available exploit code exists (gist by sermikr0, reported by VulnCheck), and the chain converts a limited management permission into full server compromise. No public evidence of active exploitation has been confirmed (not in CISA KEV).
RemediationAI
No vendor-released patch version was identified at time of analysis, so apply compensating controls. As the primary mitigation, restrict assignment of the 'user: manage users' permission to fully trusted administrators only, since this is the prerequisite capability the attack abuses; review existing custom roles and remove 'user: manage users' from any non-administrator role. Additionally, limit or disable the admin package installer ('system: manage packages') and restrict who can reach the admin API, recognizing the trade-off that this blocks legitimate extension installation and must be re-enabled manually for maintenance. Monitor user role-assignment changes and package-installation events for anomalous self-elevation. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/pagekit-cms-privilege-escalation-via-userapicontroller for details, and upgrade to a fixed release once the vendor publishes one. Do not deploy version 1.0.18 in multi-user configurations until remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pagekit is a PHP-based, modular open-source CMS built on a marketplace/package extension model where packages are PHP code installed through an admin 'package installer'. The root cause is CWE-862 (Missing Authorization): the saveAction() endpoint in UserApiController does not verify that the caller is permitted to assign the roles contained in the request, so a user with only the 'user: manage users' capability can attach any custom role - including privileged ones - to their own account. Because role-to-permission binding gates the 'system: manage packages' capability, and that capability allows installing arbitrary PHP packages, the authorization gap collapses the boundary between user administration and code execution. The single affected CPE is cpe:2.3:a:pagekit:pagekit:*:*:*:*:*:*:*:*.
Know when Pagekit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network endpoint with low-privileged authenticated account (PR:L) and no interaction; authorization bypass crosses a privilege boundary to RCE (S:C) with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Articles & Coverage 1
Executive ViewAI
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability (CVE-2026-57518, CVSS 8.7) enabling remote code execution and full server compromise. Publicly available exploit code exists for this vulnerability, increasing exploitation risk across deployed instances. Organizations running Pagekit 1.0.18 face immediate infrastructure risk with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative console access via network segmentation, IP allowlisting, and enforce multi-factor authentication; (2) Apply principle of least privilege-limit administrative permissions to essential personnel only; (3) Disable package installation features unless operationally required; (4) Deploy web application firewall and intrusion detection rules targeting exploitation signatures; (5) Implement comprehensive audit logging for administrative actions, privilege escalations, and package operations with real-time alerting; (6) Conduct targeted security assessments of Pagekit deployments; (7) Prepare rapid deployment procedure for vendor patches upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Authenticated attackers with low privileges can upload a crafted PHP file to Pagekit CMS 1.0.18 via the /storage/poc.php
Privilege escalation in Pagekit CMS 1.0.18 via an insecure direct object reference (CWE-639) lets an attacker manipulate
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload maliciou
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a
An issue was discovered in Pagekit CMS before 1.0.11. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateA
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or H
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability. Rated medium severity (CVSS 6.1), this vu
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. Rated medium severity (CVSS 5.4),
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a val
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. Rated medium severity (CVSS 4
Exploit-DB