CVE-2026-90709: Yot CMS Admin Console admin.php eval code injection
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Yot CMS versions up to and including 3.3.1 are affected. The vulnerable functionality is in the Admin Console component, specifically modsys/console/admin.php.
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the provided severity vector indicates high privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
Manipulation of the text argument to the eval function can result in code injection. The supplied vector rates confidentiality, integrity, and availability impact as low.
How urgent is remediation?
The issue is rated medium severity with a 4.7 score. A public exploit has been disclosed and may be used, which increases the practical risk for exposed administrative consoles.