ROBERT KRUCZEK
← Back to home

CVE-2026-54611

CWE-94 Improper Control of Generation of Code ('Code Injection') CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS v3.1: 5.5 (MEDIUM) Published: July 31, 2026 View on NVD →

Description

Remote Code Execution (RCE) in InstantCMS before 2.17.3 allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server; however, it won't be installed, but uploaded files will be executed. Normally all php files in the upload folder are not executed, however, by uploading a custom .htaccess it becomes possible.

Affected Products

Vendor Product Versions Affected
InstantCMS InstantCMS 0 (<= 2.17.3) (affected)

CVSS Score & Vector

Base Score: 5.5 (MEDIUM)
Vector (v3.1):
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Credits / Discoverer

  • Kamil Szczurowski (Szczurowsky)
  • Robert Kruczek (ProXy)

References & Advisories