CVE-2026-71232

7.2 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows execution of dangerous PHP functions in template content due to incomplete blacklist filtering, enabling remote code execution.
Exploitability: Exploitation requires access to the admin panel and knowledge of the affected version; moderate difficulty.
Blast radius: If exploited, it could lead to full server compromise, data theft, or denial of service for MacCMS10 installations.
Prioritized remediation: Update to a patched version of MacCMS10 or apply custom filtering to block all dangerous PHP functions.

rcewebphpadmin-panel

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0

All references

https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.