EUVD-2026-84493
GHSA-37fp-74rg-cfpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged CMS access
-
DeliveryInject PHP into $_CMS['site'] value
-
ExploitValue reaches eval() in weasel.php
-
ExecutionExecute arbitrary PHP on server
-
ImpactFull web-application compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control the $_CMS['site'] argument that the Template Engine passes into PHP eval() in cms/weasel.php - per the CVSS 4.0 vector this demands high privileges (PR:H), consistent with template/site-administration access, plus passive user interaction (UI:P). It is remote (AV:N) and low-complexity (AC:L) once those privileges are held. Limiting factors: the PR:H requirement means it is NOT unauthenticated/default-config exploitable, no patched version is published (rolling release), and the affected product is a niche PHP CMS, so realistic exposure is confined to the small set of deployments where an attacker can already influence the template site variable. |
| Impact | The single-source vendor rating (VulDB CVSS 4.0 = 1.9, Low) materially understates the technical severity: this is a CWE-94 code-injection flaw where attacker-controlled $_CMS['site'] reaches a PHP eval() in cms/weasel.php, which is effectively full remote code execution, not the VC:L/VI:L/VA:L (all Low) impacts the vendor assigned. My independent assessment rates it ~7.2 (High) on the technical merits. Several real-world signals pull risk DOWN: the CVSS 4.0 vector requires PR:H (privileged control over the template variable) and UI:P (passive user interaction); exploitation status is 'publicly available exploit code exists' (POC via VulDB) but this is NOT active exploitation - it is NOT in CISA KEV and no EPSS score is provided. The dominant risk-limiter is prevalence: APENCMS is an obscure hobby/rolling-release PHP CMS with negligible production footprint, so even a full RCE has little aggregate exposure. CONFLICT TO NOTE EXPLICITLY: the vendor's Low base score conflicts with the eval()-based RCE technical impact - treat the 1.9 as anomalously low and prioritize by technical severity gated behind PR:H. Net: a genuine RCE bug but a targeted/niche concern rather than a fleet-wide priority. |
| Exploit ScenarioDerived | An attacker who already holds privileged/authenticated access (e.g., a template or site administrator) supplies a crafted $_CMS['site'] value that is passed unsanitized into eval() within the template engine (cms/weasel.php), causing arbitrary PHP to execute on the server. A public proof-of-concept exists (VulDB), lowering the skill needed to reproduce it, though the CVSS vector's UI:P implies some victim interaction in the delivery path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Code injection in mtrano APENCMS (rolling release, all builds up to commit 6546096d354153309693efabb9a0d824628ed4f5) lets a remote attacker who already holds high-privilege template or site administration access reach a PHP eval() call in cms/weasel.php through the $_CMS['site'] argument and execute arbitrary code on the server. Publicly available exploit code exists, while the vendor was contacted and did not respond, so no fixed build and no published version boundaries are available. The CNA's CVSS 4.0 base score of 1.9 (Low, all impacts rated VC:L/VI:L/VA:L) understates the technical severity: with attacker-controlled input flowing into eval(), successful exploitation is effectively full server-side code execution, and the attacker must already control the template/site variable (PR:H), consistent with template or site administrator rights rather than an unauthenticated default-configuration attack.
RemediationAI
No vendor-released patch identified at time of analysis: mtrano was contacted about this disclosure and did not respond, and the rolling-release model means no fixed build number is published, so there is no version to upgrade to and no upstream PR/commit to cite as a fix. The most effective compensating control mirrors the PR:H precondition - treat template/site administration as a trusted, tightly limited role: restrict the CMS admin and template-editing interfaces to a management network or VPN (not the public internet), enforce least privilege and multi-factor authentication so that no low-trust account can set $_CMS['site'], and remove or disable the eval()-based rendering path in cms/weasel.php rather than sanitising it (side effect: any template feature that relies on dynamically evaluated site configuration stops working, which must be validated against the site's templates). Where the code cannot be changed, replace the dynamic $_CMS['site'] value with a hard-coded whitelist lookup of permitted site identifiers before it is used, which preserves multi-site routing while breaking the injection primitive. As an additional layer, place the application behind a WAF rule that blocks requests whose parameters contain PHP constructs such as <?php, system(, or eval( (bypassable via encoding/obfuscation, so not a substitute for privilege restriction), and monitor PHP-FPM/web logs for unexpected eval-related errors or outbound connections from the CMS host. Given the absence of vendor maintenance and the existence of public exploit code, migration to a maintained CMS should be evaluated if a code-level fix cannot be applied promptly; the only public technical detail remains the VulDB entry at https://vuldb.com/vuln/408349.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-94 improper control of code generation (code injection) in a PHP-based template engine. In cms/weasel.php, the function eval takes the value of $_CMS['site'] and feeds it into PHP's eval() language construct, which interprets its argument as PHP source rather than as data. Because $_CMS['site'] originates from request/site input that a template or site administrator can influence, an attacker who can set that value writes the PHP they want evaluated, achieving arbitrary code execution in the context of the web/PHP process that serves apencms. The CPE record cpe:2.3:a:mtrano:apencms:*:*:*:*:*:*:*:* uses a wildcard version field, which corroborates that no bounded affected-version range is published: apencms follows a rolling release model, so every deployed build prior to the current commit hash is potentially vulnerable and cannot be enumerated by version string. The CNA's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L, E:P) plus the VulDB-reported POC are the only authoritative data points; the independent assessment re-scores the same root cause as CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, since injecting code into eval yields high confidentiality, integrity and availability impact rather than Low, with the CVSS 4.0 E:P (public proof-of-concept exploit maturity) metric confirming the exploit code is real and shareable.
Know when Apencms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Controlling $_CMS['site'] requires privileged/template access (PR:H) with some victim interaction (UI:R); eval() yields full PHP RCE, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB