Pagekit EUVD-2026-23878

Exploitation requires high-privilege administrative access to Pagekit CMS (PR:H from CVSS vector) - the attacker must either possess valid admin credentials or have compromised an admin account. The vulnerability is triggered when a high-privilege user modifies or uploads template content through the StringStorage Template Handler component, and the evaluate function in PhpEngine.php processes that template without properly neutralizing PHP directives. No special non-default configuration or feature enablement is required - the vulnerable code path is part of the standard template processing mechanism. The attack is network-accessible (AV:N) but NOT unauthenticated; it cannot be exploited by anonymous remote users. This significantly limits real-world risk compared to unauthenticated remote code execution, restricting the threat to scenarios involving compromised admin accounts, insider threats, or multi-step attacks that first gain admin access through other means.

CVSS score of 4.7 with a network attack vector and low complexity reflects a moderate baseline risk, but several factors require careful interpretation. The CVSS vector shows PR:H (requires high/admin privileges), which significantly constrains real-world exploitation compared to unauthenticated attacks - this is a critical limiting factor. However, the E:P (exploit code proof-of-concept publicly available) modifier and confirmed POC availability increase the practical risk for organizations where admin accounts are compromised or where insider threats exist. The absence of EPSS scoring and KEV status in the provided data means we cannot compare exploitation probability against typical attack patterns, but the public POC availability and vendor non-response suggest potential but not confirmed widespread exploitation. Organizations with strong admin credential protection and limited administrative user accounts face substantially lower risk than those with shared or weakly-managed admin access. This is not a high-priority vulnerability for well-segmented enterprises, but becomes critical for installations with lax admin access controls.

An attacker with stolen or socially-engineered admin credentials logs into the Pagekit CMS administrative panel, navigates to the template editor, and injects malicious PHP code into a template string that is processed by the PhpEngine evaluate function. The injected code executes with the privileges of the web server process, allowing the attacker to exfiltrate sensitive data, modify database records, or establish a persistent backdoor. Publicly available POC code demonstrates this injection technique, reducing the skill barrier for non-sophisticated threat actors.