CVE-2026-54611: InstantCMS has Remote Code Execution in package installer
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstantCMSto a version that resolves this vulnerability.Fixed in 2.18.2 - Configuration
Ensure uploaded files from the upload folder cannot be used to enable execution (e.g., prevent custom .htaccess from causing uploaded PHP to be executed).
InstantCMS upload folder .htaccess handling / execution of uploaded PHP = disallow execution enabled via custom .htaccess
Event History
Frequently Asked Questions
Which InstantCMS deployments are affected?
InstantCMS versions prior to 2.18.2 are affected. Version 2.18.2 contains the fix.
What access does an attacker need to exploit this issue?
An attacker must be authenticated and able to use the component installer. Exploitation involves uploading a malicious component and a custom .htaccess file so that uploaded PHP files can be executed.
Are uploaded PHP files normally executable?
Normally, PHP files in the upload folder are not executed. The issue can be exploited by uploading a custom .htaccess file that changes this behavior.