Which versions of PHP are affected by EUVD-2026-18226?

DefaultFunction Content-Management-System 1.0 contains an unauthenticated remote command injection vulnerability in its admin tools that allows attackers to execute arbitrary operating system…

Is there a public PoC exploit available for EUVD-2026-18226?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18226. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2026-18226?

Within 24 hours: immediately inventory all systems running DefaultFunction CMS 1.0, isolate affected instances from production networks if possible, and restrict network access to /admin/tools.php to trusted IP ranges only. Within 7 days: evaluate migration to a patched alternative or hardened version if vendor releases one; implement Web Application Firewall (WAF) rules to block malicious host parameter payloads; enable comprehensive logging and monitoring on all DefaultFunction CMS instances. Within 30 days: complete migration off DefaultFunction CMS 1.0 to a supported, patched content management system or retire the application entirely.

PHP EUVD-2026-18226

Q: What is the CVSS score of EUVD-2026-18226?

EUVD-2026-18226 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-5333 MEDIUM

Command Injection (CWE-77)

2026-04-02 VulDB

GHSA-p458-m7mj-jhv3

Command Injection PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 18:55 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 13:45 euvd

EUVD-2026-18226

Analysis Generated

Apr 02, 2026 - 13:45 vuln.today

CVE Published

Apr 02, 2026 - 13:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote command injection in DefaultFuction Content-Management-System 1.0 allows unauthenticated attackers to execute arbitrary OS commands via the host parameter in /admin/tools.php. The flaw has a publicly available exploit (POC published on GitHub) and is exploitable over the network with low attack complexity. EPSS data not available, not listed in CISA KEV. CVSS 7.3 reflects network-accessible, unauthenticated command injection with potential for confidentiality, integrity, and availability compromise.

Technical ContextAI

This vulnerability manifests in the /admin/tools.php administrative endpoint of DefaultFuction Content-Management-System version 1.0, a PHP-based content management platform. The root cause is CWE-77 (Command Injection), where user-supplied input to the 'host' parameter is improperly sanitized before being passed to system command execution functions. In PHP applications, this typically occurs when functions like exec(), system(), passthru(), or shell_exec() process untrusted input without validation or escaping. The affected CPE (cpe:2.3:a:defaultfuction:content-management-system:*:*:*:*:*:*:*:*) identifies this as a vendor-specific CMS implementation. The administrative path suggests this endpoint may be intended for diagnostic or network utility functions (ping, nslookup, etc.) that invoke shell commands, creating the injection surface.

RemediationAI

No vendor-released patch identified at time of analysis. The primary GitHub repository (https://github.com/DefaultFuction/Content-Management-System/) should be monitored for security updates addressing issue #1. Immediate mitigations include: restrict network access to /admin/tools.php through web server configuration (deny external access, whitelist trusted IPs only), implement web application firewall rules to detect and block command injection patterns in the host parameter, disable or remove the vulnerable tools.php functionality if not operationally required, and conduct code-level input validation by sanitizing the host parameter using escapeshellarg() or equivalent PHP sanitization functions before any system command invocation. Organizations should consider migrating to actively maintained CMS platforms with established security response processes. Monitor VulDB reference https://vuldb.com/vuln/354667 and the GitHub issue thread for vendor response and patch availability.