CVE-2026-29014: MetInfo CMS Unauthenticated PHP Code Injection RCE

Published Apr 1, 2026

Updated

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Affected Software

4 affected components

Metinfo MetInfo CMS=7.9, =8.0, =8.1

Metinfo Metinfo=7.9

Metinfo Metinfo=8.0.0

Metinfo Metinfo=8.1

Event History

Apr 1, 2026

CVE Published

via MITRE·12:22 PM

Data Sourced

via MITRE·12:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-29014?

CVE-2026-29014 is considered to be a critical severity vulnerability due to its potential for unauthenticated remote code execution.

How do I fix CVE-2026-29014?

To fix CVE-2026-29014, update MetInfo CMS to the latest version that addresses this vulnerability.

What versions of MetInfo CMS are affected by CVE-2026-29014?

CVE-2026-29014 affects MetInfo CMS versions 7.9, 8.0, and 8.1.

Can CVE-2026-29014 be exploited without authentication?

Yes, CVE-2026-29014 can be exploited without authentication, allowing attackers to execute arbitrary code remotely.

What kind of attacks are possible due to CVE-2026-29014?

CVE-2026-29014 allows attackers to perform remote code execution attacks by sending crafted requests with malicious PHP code.