CVE-2026-54611

Deferred Deferred - Pending Action

Remote Code Execution in InstantCMS

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: GitHub, Inc.

Description

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-54611

Affected Vendors & Products

Vendor	Product	Version / Range
instantcms	instantcms	to 2.18.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a Remote Code Execution (RCE) issue in InstantCMS versions prior to 2.18.2. It allows remote authenticated attackers to execute any PHP code via the component installer. Attackers can upload a malicious component that executes files in the upload folder by leveraging a custom .htaccess file to bypass normal restrictions.

Detection Guidance

Check for unauthorized PHP files in the upload directory, especially those with unusual names or recent modification dates. Review .htaccess files in upload folders for suspicious rules that enable PHP execution. Inspect network traffic for unusual outbound connections from the server.

Impact Analysis

This vulnerability allows attackers to execute arbitrary PHP code on your server if they have authenticated access. This could lead to full system compromise, data theft, or unauthorized modifications to your website or server.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade InstantCMS to version 2.18.2 or later immediately. Remove any unauthorized files in the upload directory. Restrict write permissions to the upload folder. Monitor server logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-54611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70