CVE-2026-105329

MEDIUM 6.3

TallCMS PluginManager ThemeManager.php code injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.

CWE	CWE-94 CWE-74
Vendor	n/a
Product	tallcms
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for n/a tallcms

Be the first to know when new medium vulnerabilities affecting n/a tallcms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / TallCMS

4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/413543 vuldb.com: https://vuldb.com/vuln/413543/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105329 vuldb.com: https://vuldb.com/submit/979800 github.com: https://github.com/tallcms/tallcms/issues/122 github.com: https://github.com/tallcms/tallcms/pull/124 github.com: https://github.com/beegoodit/tallcms/commit/fdc18f4c6a36134f8986ca1d7e4e97092e3deb93 github.com: https://github.com/tallcms/tallcms/

Credits

🔍 liaoxijun100 (VulDB User)