CVEvulnerability

CVE-2026-54611

5.5 MEDIUM Published 2026-09-08 Modified 2026-09-09 Official page ↗

Status: Deferred
Published: 2026-09-08
Last modified: 2026-09-09
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weaknesses: CWE-434, CWE-94

Description

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Weakness · CWE (2)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://github.com/instantsoft/icms2/commit/44f3a9d04a3207c82cdc756599cbdf084a02858f github.com
https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5 github.com
https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5 github.com

CVE-2026-54611

Description

Related

Weakness · CWE (2)

References