CVE-2026-71232
Received Received - Intake

Remote Code Execution in MacCMS10 Template Editor

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition="exec('id > /tmp/pwned.txt')"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71232
EUVD
EUVD-2026-53305

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thinkphp thinkphp to 2026-06-22 (inc)
magicblack maccms10 to 2026-06-22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MacCMS10 allows authenticated administrators to execute arbitrary PHP code through the admin template editor. The blacklist regex used to block dangerous functions missed several critical functions like exec and passthru. Combined with ThinkPHP's template tag, attackers can inject malicious PHP code via template conditions to achieve remote code execution.

Detection Guidance

Check for unauthorized files like /tmp/pwned.txt or suspicious PHP code in template files. Review admin template editor logs for {if} tags with exec or similar functions. Search for ThinkPHP admin panel access patterns.

Impact Analysis

If exploited, this vulnerability allows attackers with admin access to execute arbitrary commands on the server. This could lead to full system compromise, data theft, or unauthorized modifications. The impact depends on server permissions and the sensitivity of stored data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance breaches if exploited, resulting in legal penalties or reputational damage.

Mitigation Strategies

Update MacCMS10 to the fixed commit 71ad3bb29570e110d8e973acff68040a3050ddf0. Remove dangerous PHP functions from template editor blacklist. Restrict admin access to trusted users only. Monitor for unauthorized file creation or code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart