What is the CVSS score of CVE-2026-71232?

CVE-2026-71232 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2026-71232?

CVE-2026-71232 affects MacCMS10's admin template editor, allowing authenticated administrators to execute arbitrary operating system commands through template injection.. A patch is available.

How to fix or mitigate CVE-2026-71232?

Within 24 hours: Inventory all MacCMS10 deployments and current administrator account holders; implement access logging and audit trails for admin template editor; restrict admin console access to trusted networks only if possible. Within 7 days: Verify if MacCMS10 version with upstream fix (committed 2026-06-22) is available for deployment; consult vendor advisories for patch availability and exact version information; consider disabling the admin template editor if not actively used. Within 30 days: Complete testing and deployment of patched MacCMS10 version across all affected systems; conduct forensic review of admin activity logs for any unauthorized template modifications; establish monitoring rules to detect suspicious template injection payloads.

PHP CVE-2026-71232

EUVD-2026-53305 HIGH

Code Injection (CWE-94)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-cv48-22qx-mpmx

PHP RCE Code Injection

7.2

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) · only source for this CVE.

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 05, 2026 - 12:01 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 11:34 vuln.today

Analysis Generated

Aug 05, 2026 - 11:34 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 7.2

DescriptionCVE.org

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition="exec('id > /tmp/pwned.txt')"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter.

AnalysisAI

Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native {if} template tag. The Template.php controller filtered dangerous functions via regex but omitted exec, passthru, popen, create_function, register_shutdown_function, register_tick_function, show_source, and error_log, allowing payloads such as {if condition="exec('id > /tmp/pwned.txt')"}{/if} to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.