Is there a public PoC exploit available for CVE-2026-6652?

Yes, a public proof-of-concept exploit is available for CVE-2026-6652. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6652

Q: What is the CVSS score of CVE-2026-6652?

CVE-2026-6652 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23878 LOW

Eval Injection (CWE-95)

2026-04-20 VulDB

GHSA-gv64-vfgp-cgh5

PHP Information Disclosure Code Injection Cms Pagekit

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 20, 2026 - 16:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 15:51 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 15:15 euvd

EUVD-2026-23878

Analysis Generated

Apr 20, 2026 - 15:15 vuln.today

CVE Published

Apr 20, 2026 - 15:00 nvd

LOW 2.0

DescriptionCVE.org

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper neutralization of directives in dynamically evaluated code in Pagekit CMS up to version 1.0.18 allows high-privileged remote attackers to inject and execute arbitrary PHP code through the StringStorage Template Handler's evaluate function in app/modules/view/src/PhpEngine.php. The vulnerability requires administrator-level access but enables information disclosure, code injection, and potential system compromise. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.

Technical ContextAI

Pagekit CMS implements a PHP template engine (PhpEngine.php) that processes template directives through a StringStorage Template Handler. The evaluate function improperly neutralizes code directives within dynamically evaluated PHP, creating a code injection vector. This is rooted in CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), which occurs when user-supplied or template-supplied input is passed to PHP's eval() function or equivalent dynamic code execution mechanisms without proper sanitization or encoding. The vulnerability affects the templating system at the application level, allowing attackers with administrative credentials to manipulate template syntax and inject arbitrary PHP commands that execute in the context of the web application.

RemediationAI

No vendor-released patch is identified at time of analysis - the vendor did not respond to early disclosure and no official patch version has been confirmed. Organizations using Pagekit CMS 1.0.18 or earlier should immediately restrict administrative user access to trusted personnel only, disable template upload/editing features if not essential to operations, and implement network-level access controls to limit who can authenticate to the CMS admin panel. As a compensating control, disable PHP's eval() function globally via php.ini (disable_functions = eval) if your application architecture permits, though this may break legitimate templating features - test thoroughly before deployment. Alternatively, isolate the Pagekit installation on a separate network segment with restricted outbound access to prevent lateral movement if the admin account is compromised. Monitor admin account activity and template modifications closely. Consider upgrading to a fork or alternative CMS if Pagekit is no longer actively maintained.