Is there a public PoC exploit available for EUVD-2026-26251?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26251. Prioritise patching immediately. EPSS: 0.0%.

EyouCMS EUVD-2026-26251

Q: What is the CVSS score of EUVD-2026-26251?

EUVD-2026-26251 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7388 LOW

Code Injection (CWE-94)

2026-04-29 VulDB

PHP RCE Code Injection Eyoucms N A

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin credentials required (PR:H), but successful code injection yields full OS-level code execution, constituting a scope change with high C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:48 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 16:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 15:30 euvd

EUVD-2026-26251

CVE Published

Apr 29, 2026 - 15:15 nvd

LOW 2.0

DescriptionCVE.org

A weakness has been identified in EyouCMS up to 1.7.9. Impacted is the function editFile of the file application/admin/logic/FilemanagerLogic.php of the component Template File Handler. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Code injection in EyouCMS versions 1.7.0 through 1.7.9 allows authenticated administrators to execute arbitrary PHP code via the Template File Handler's editFile function in FilemanagerLogic.php, enabling remote code execution on the underlying server. All versions across the entire 1.7.x branch are affected, and a proof-of-concept exploit is publicly available on Gitee. This vulnerability is not listed in CISA KEV; EPSS at 0.04% and SSVC automatable:no reflect the high-privilege prerequisite that limits mass exploitation, though the public POC lowers the bar for targeted insider or credential-compromise attacks.

Technical ContextAI

EyouCMS is a PHP-based content management system. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code), meaning user-supplied input is written into PHP template files without adequate sanitization, and those files are subsequently executed by the PHP interpreter when a page request renders the template. The affected code path is the editFile method within application/admin/logic/FilemanagerLogic.php, part of the Template File Handler component. PHP CMS platforms that allow admin-level file editing are structurally prone to this class of flaw because the template engine and the PHP runtime share the same execution context. The CPE identifier cpe:2.3:a:n/a:eyoucms:*:*:*:*:*:*:*:* covers the affected product family; the n/a vendor field in the CPE suggests no authoritative NVD vendor mapping has been established, which is consistent with a niche CMS with limited vendor engagement.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor was notified through responsible disclosure but has not responded. The primary compensating control is to restrict access to the EyouCMS administrative panel to trusted IP addresses or VPN-only networks, which eliminates remote exploitation by external attackers while preserving admin functionality; the trade-off is operational overhead for distributed admin teams. If template file editing is not required for day-to-day operations, disabling or removing access to the Template File Handler component in application/admin/logic/FilemanagerLogic.php reduces the attack surface directly. File integrity monitoring on the CMS template directory can serve as a detection control to alert on unexpected PHP payload insertion. Web Application Firewall rules targeting PHP code injection patterns (e.g., eval(), system(), passthru()) may reduce exploitation success but cannot be considered a reliable mitigation. If a patch is not released in a reasonable timeframe, migration to an actively maintained CMS should be evaluated. References: VulDB advisory at https://vuldb.com/vuln/360113, POC at https://gitee.com/weng_xianhu/eyoucms/issues/IILDJS.