CVE-2026-71232: MacCMS10: Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition="exec('id > /tmp/pwned.txt')"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ThinkPHP template {if} tag handling / filter functionsto a version that resolves this vulnerability.Patch 71ad3bb29570e110d8e973acff68040a3050ddf0 - Configuration
Update the blacklist regex in application/admin/controller/Template.php so template content blocks the missing dangerous PHP functions (exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log) that were omitted.
MacCMS10 admin template editor (application/admin/controller/Template.php) template content function blacklist regex = Add missing dangerous PHP functions: exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, error_log
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71232?
The severity of CVE-2026-71232 is high with a score of 7.2.
How do I fix CVE-2026-71232?
To fix CVE-2026-71232, you should update the MacCMS10 admin template editor to incorporate a more comprehensive blacklist for dangerous PHP functions.
What kind of attacks does CVE-2026-71232 allow?
CVE-2026-71232 allows authenticated remote code execution due to incomplete function blacklisting in the template editor.
Which PHP functions are misconfigured in CVE-2026-71232?
CVE-2026-71232 misconfigures functions such as exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
Who is affected by CVE-2026-71232?
Anyone using the MacCMS10 admin template editor is potentially affected by CVE-2026-71232, specifically if they rely on the template content functionality.