ImpressCMS EUVD-2026-58789

Exploitation requires a fully authenticated administrator account on the target ImpressCMS instance - the CVSS 4.0 vector confirms PR:H (high privileges required), meaning standard registered user access is insufficient. The custom tag module must be enabled and the attacker's administrator account must have permission to create or edit custom tags with the PHP type option enabled. Once the malicious tag is stored, no further attacker interaction is required: the preload event system automatically executes the payload on every subsequent frontend page load, including requests from unauthenticated visitors. What limits initial exploitation: administrator authentication is the hard prerequisite - environments enforcing MFA, strong unique passwords, and minimal admin account counts substantially reduce exposure. Non-admin authenticated users cannot exploit this vulnerability. There is no indication of a network-path-only limitation; the admin panel itself must be reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.6 and reflects full confidentiality, integrity, and availability impact on the vulnerable system, with no subsequent-system impact. The PR:H requirement is the primary constraint: exploitation requires a fully authenticated administrator account, not merely a registered user, which materially limits the realistic attack surface relative to the raw score. The absence of CISA KEV listing and EPSS data in the provided intelligence leaves exploitation frequency unquantified; however, a public PoC on GitHub (DevVaibhav07/VULN-POC) lowers the skill barrier for any attacker who has already obtained admin credentials. The persistent, self-triggering nature of the stored payload - executing on every frontend request via the preload system - amplifies post-exploitation impact significantly: a single successful write creates a persistent implant without requiring repeated attacker access. Real-world priority is moderate-to-high for organizations where administrator account hygiene is weak or where shared admin credentials exist; lower for hardened environments with MFA and minimal admin accounts. No conflicting signals between the CVSS vector and description text were identified.

An attacker who has acquired administrator credentials - through phishing, credential stuffing, or password reuse - logs into the ImpressCMS admin panel and creates or edits a custom tag with PHP type enabled, inserting HTML-encoded PHP code such as a reverse shell or web shell payload. The undoHtmlSpecialChars() function decodes the payload before eval() executes it on the next page load, and from that point forward every unauthenticated visitor's browser request to any frontend page silently re-executes the attacker's code as the web server process. A public proof-of-concept documenting this technique is available at https://github.com/DevVaibhav07/VULN-POC/blob/main/ImpressCMSRCCE.md.