CVE-2026-90788: magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that the attacker needs high privileges. The attack can be initiated remotely and does not require user interaction.
How urgent is remediation?
A public exploit has been released and may be used in attacks. The vendor was notified through an issue report but had not responded at the time of publication.
Which deployments should be considered potentially exposed?
Deployments of magicblack MacCMS10 version 2026.1000.4055 using the Template Handler should be assessed. The affected functionality is associated with the administrative template path under /admin1.php/admin/template/index/path/.