EUVD-2026-83815
GHSA-4f78-fq9v-h5c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged CMS account
-
DeliveryInject PHP payload into page content field
-
ExploitRenderer passes content to eval()
-
ExecutionExecute arbitrary PHP on server
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated, privileged RooCMS account (administrator or content-editor role) able to author the page 'content' that site_pagePHP.php passes to eval() during frontend rendering - this is the PR:H gate, not a default-open remote surface. Exploitation is limited to RooCMS installations at or below 1.2.2/1.3.4/1.4RC2; no user interaction by a victim is needed, but the attacker must control content-editing privileges, which sharply limits realistic exposure to insiders or attackers who have already compromised an editor credential. |
| Impact | This is a genuine code-injection flaw (CWE-94) reaching a PHP eval() on the 'content' argument in RooCMS's frontend page renderer - the highest-severity primitive possible short of nothing. However, the real-world priority is moderate. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L, base 5.1) uses PR:H, indicating the attacker needs elevated privileges - consistent with 'content' being admin/editor-authored page content that gets eval'd, not attacker-supplied unauthenticated input. The vendor's impact rating of VC:L/VI:L/VA:L is inconsistent with an eval() sink: successful PHP code injection yields full confidentiality, integrity, and availability compromise, so I assess impact as High and my 3.1 base as ~7.2. Signals conflict: SSVC exploitation is E:P (proof-of-concept, a public POC exists on GitHub) but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or automatable exploitation. Net: real vulnerability, credible POC, but gated behind privileged access and confined to an obscure product - treat as a patch-when-able issue rather than an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a privileged CMS account (administrator or content editor) injects a PHP payload into a page's 'content' field, which RooCMS's site_pagePHP.php passes to eval() during frontend rendering, executing arbitrary PHP on the server. A public proof-of-concept exists (GitHub boyslikesports/202607_vul_dir), lowering the effort to reproduce. Because PR:H applies, this is primarily a privilege-to-RCE escalation for an insider or a compromised editor credential rather than a drive-by remote takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Code injection in RooCMS (versions up to and including 1.2.2, 1.3.4 and 1.4RC2) allows an attacker who holds a privileged content-editing or administrator account to place PHP code into a page's 'content' field, which the frontend renderer passes to eval() in roocms/site_pagePHP.php, resulting in arbitrary PHP execution on the server. The flaw is CWE-94 and is remotely reachable, but exploitation is gated behind high privileges (CVSS:4.0 PR:H / CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so realistic exposure is limited to insiders or attackers who have already obtained editor credentials rather than an anonymous internet-facing surface. Publicly available exploit code exists (a public proof-of-concept write-up is referenced), the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early and did not respond, and no fixed version is published, so remediation must be compensating. First, remove the dangerous sink: in roocms/site_pagePHP.php, replace the eval() call on the page 'content' argument with a non-evaluating rendering path (e.g. include of a vetted template file, or output through htmlspecialchars/strip_tags), then re-test page rendering; the trade-off is that any legitimate pages relying on inline PHP in their content will stop executing and must be migrated to templates or plugins. Second, treat page-authoring rights as equivalent to server compromise: immediately review and reduce accounts holding administrator or content-editor roles, rotate their credentials, and force re-authentication, since an attacker with an editor login can reach this sink directly - this shrinks the PR:H exposure but will disrupt editorial workflows until roles are re-provisioned. Third, restrict access to the administrative/editor interface to trusted source addresses via web-server ACLs or a VPN/reverse-proxy allowlist, accepting that remote editors lose direct access. Fourth, deploy a WAF rule rejecting PHP opening tags and eval-style constructs (for example <?php, <?=, and backtick/system-style sequences) in submitted page content and in any field persisted to the pages table; expect false positives where editors legitimately paste code snippets, so run the rule in detection mode first. Finally, hunt for prior exploitation by searching the pages table and web-root for injected PHP tags, webshell artefacts and unexpected recently modified files, and audit web-server and application logs for requests to page endpoints with anomalous content payloads - because public exploit code exists, assume attempts have already been made against internet-exposed installations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is RooCMS's frontend rendering path, specifically the function eval() in roocms/site_pagePHP.php, which processes the 'content' argument supplied when a page is authored or edited. Because that content is handed directly to PHP's eval() instead of being safely templated, escaped or sandboxed, any PHP statements embedded in the page body are executed in the context of the web server process - the classic CWE-94 code-injection pattern where data is treated as code. The CPE entry cpe:2.3:a:n/a:roocms:*:*:*:*:*:*:*:* is an unconstrained wildcard, meaning the upstream record itself does not pin a specific build; the version ceilings in the description (1.2.2 / 1.3.4 / 1.4RC2) are the only scoping available. Tags confirm the stack characteristics: PHP application, code injection leading to remote code execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/E:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) agree on the essentials: no user interaction, network-reachable, but a high-privilege prerequisite - the eval() sink is only reachable by someone who can write page content, and no attack complexity or unusual precondition beyond that credential is required. Practical consequences of the sink are severe because eval() runs with the full rights of the PHP process, enabling webshell placement, file-system access, database credential theft from configuration files, and lateral movement.
Know when Roocms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable admin content field feeds eval(), so AV:N/AC:L/PR:H/UI:N; PHP code execution yields full C:H/I:H/A:H, overriding the vendor's understated :L impacts.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB