CVE-2026-6652
Improper Directive Neutralization in Pagekit CMS Enables Remote Code Execution
Publication date: 2026-04-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pagekit | cms | to 1.0.18 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-95 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Pagekit CMS up to version 1.0.18, specifically in the evaluate function of the file app/modules/view/src/PhpEngine.php within the StringStorage Template Handler component.
The issue is caused by improper neutralization of directives in dynamically evaluated code, which means that certain code directives are not properly sanitized or handled before being executed.
Because of this weakness, an attacker can remotely exploit the system by injecting malicious directives that get executed, potentially leading to unauthorized actions.
The exploit code for this vulnerability has been made publicly available, increasing the risk of attacks.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute malicious code through the evaluate function in the affected Pagekit CMS versions.
The impact includes potential unauthorized code execution which can lead to data compromise, system manipulation, or further exploitation of the affected system.
Since the exploit is publicly available, the risk of being targeted by automated or manual attacks is higher.