CVE-2026-6652
Received Received - Intake
Improper Directive Neutralization in Pagekit CMS Enables Remote Code Execution

Publication date: 2026-04-20

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-20
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-04-20
EPSS Evaluated
2026-06-14
NVD
CVE-2026-6652
EUVD
EUVD-2026-23878
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
pagekit cms to 1.0.18 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Pagekit CMS up to version 1.0.18, specifically in the evaluate function of the file app/modules/view/src/PhpEngine.php within the StringStorage Template Handler component.

The issue is caused by improper neutralization of directives in dynamically evaluated code, which means that certain code directives are not properly sanitized or handled before being executed.

Because of this weakness, an attacker can remotely exploit the system by injecting malicious directives that get executed, potentially leading to unauthorized actions.

The exploit code for this vulnerability has been made publicly available, increasing the risk of attacks.

Impact Analysis

This vulnerability allows remote attackers to execute malicious code through the evaluate function in the affected Pagekit CMS versions.

The impact includes potential unauthorized code execution which can lead to data compromise, system manipulation, or further exploitation of the affected system.

Since the exploit is publicly available, the risk of being targeted by automated or manual attacks is higher.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart