CVE-2026-88418

Received Received - Intake

CSRF Bypass Leading to RCE in CMSimple

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-88418

EUVD

EUVD-2026-84857

Affected Vendors & Products

Vendor	Product	Version / Range
cmsimple	cmsimple	5.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-88418 is a critical vulnerability in CMSimple 5.24 where CSRF protection is disabled by default. This allows unauthenticated attackers to inject PHP code via a scripting marker (#CMSimple ...#) stored in a file. The injected code is executed on every page load using PHP eval(), resulting in persistent remote code execution on the server.

Detection Guidance

Check for unauthorized PHP code in content/content.php or suspicious scripting markers like #CMSimple ...#. Review admin forms for missing csrf_token hidden fields. Inspect server logs for unusual POST requests to admin endpoints.

Impact Analysis

An attacker can gain full control over your web server by tricking an administrator into visiting a malicious link. This allows them to execute arbitrary PHP code, steal sensitive data, modify website content, or install malware. All visitors to the site, including unauthenticated users, are affected.

Compliance Impact

This vulnerability can lead to data breaches, unauthorized access, and loss of sensitive information, violating GDPR and HIPAA compliance. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A successful exploit could result in regulatory fines and legal consequences.

Mitigation Strategies

Enable CSRF protection in CMSimple 5.24 settings. Restrict administrative access via IP whitelisting or VPN. Remove eval() usage in functions.php. Update to a patched version if available. Monitor for unauthorized file changes.

Hi! I’m here to help you understand CVE-2026-88418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70