CMSimple CVE-2026-88418

Exploitation requires that CMSimple runs with its default configuration where CSRF protection is disabled (csrfProtection() is a no-op) and admin forms omit the csrf_token hidden field, and that administrator authentication is cookie-only. A victim who is a currently logged-in administrator must be induced (UI:R) to load attacker-controlled web content while holding a valid session cookie, so the forged content-save request is accepted. The attacker themselves needs no credentials (PR:N). Realistic risk is limited by the social-engineering requirement against a specific privileged, actively-authenticated user; once the scripting marker is stored in content/content.php, the eval()-based RCE then triggers automatically for all subsequent visitors including unauthenticated ones.

This is a genuine high-priority technical issue mitigated by real-world deployment factors. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is internally consistent with the description: an unauthenticated remote attacker (PR:N) exploits a CSRF weakness (CWE-352) that requires tricking a logged-in administrator into visiting a malicious page (UI:R), ultimately achieving persistent PHP eval()-based RCE with full C:H/I:H/A:H impact. The chained outcome - CSRF → stored scripting marker → server-side eval() executed for every visitor - is severe because it converts a client-side trust flaw into persistent remote code execution. However, exploitation signals temper the urgency: EPSS is only 0.33% (26th percentile), there is no CISA KEV listing, and no vendor-confirmed public exploit. The single GitHub reference (15536818056/CVE/issues/5) may contain a writeup or PoC but this is not confirmed from the provided data. The chief limiting factor is the mandatory UI:R condition - a specific administrator must be authenticated AND socially engineered into loading attacker content while their session cookie is valid - which makes this targeted rather than mass-exploitable. Note the CPE is a placeholder ('cpe:2.3:a:n/a:n/a') and EUVD affected version is 'n/a n/a', so precise affected-version boundaries are unverified beyond the description's mention of CMSimple 5.24.

An attacker crafts a malicious web page containing an auto-submitting form that POSTs a forged content-save request to a target CMSimple 5.24 admin endpoint, embedding a PHP scripting marker as the text payload. When a logged-in administrator visits the page, their browser silently submits the request using their session cookie; because CSRF protection is a no-op by default and no csrf_token is enforced, the marker is stored into content/content.php and thereafter executed via eval() on every page view for all visitors. No public exploit is confirmed in the provided data, though a GitHub issue reference exists.