CVE-2026-71232: MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71232?
The severity of CVE-2026-71232 is high with a score of 7.2.
How do I fix CVE-2026-71232?
To fix CVE-2026-71232, you should update the MacCMS10 admin template editor to incorporate a more comprehensive blacklist for dangerous PHP functions.
What kind of attacks does CVE-2026-71232 allow?
CVE-2026-71232 allows authenticated remote code execution due to incomplete function blacklisting in the template editor.
Which PHP functions are misconfigured in CVE-2026-71232?
CVE-2026-71232 misconfigures functions such as exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
Who is affected by CVE-2026-71232?
Anyone using the MacCMS10 admin template editor is potentially affected by CVE-2026-71232, specifically if they rely on the template content functionality.