CVE-2026-73679

HIGH 7.2

ImpressCMS Authenticated RCE via PHP Custom Tag eval()

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

CWE	CWE-94
Vendor	impresscms
Product	impresscms
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for impresscms impresscms

Be the first to know when new high vulnerabilities affecting impresscms impresscms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

ImpressCMS / ImpressCMS

0 ≤ 2.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ImpressCMS/impresscms github.com: https://github.com/DevVaibhav07/VULN-POC/blob/main/ImpressCMSRCCE.md vulncheck.com: https://www.vulncheck.com/advisories/impresscms-authenticated-rce-via-php-custom-tag-eval

Credits

🔍 Vaibhav Kubade