CVE-2026-105329: TallCMS PluginManager ThemeManager.php code injection
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TallCMSto a version that resolves this vulnerability.Patch fdc18f4c6a36134f8986ca1d7e4e97092e3deb93
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates that an attacker needs low-level privileges (PR:L). No user interaction is required.
What is the likely impact if exploitation succeeds?
The vulnerability can lead to code injection. The provided severity vector indicates low impacts to confidentiality, integrity, and availability.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do to remediate this issue?
Apply the patch identified as fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. The affected scope is TallCMS through version 4.8.0, in the PluginManager component's ThemeManager.php file.