Description

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T19:18:01.610Z",
  "pubdate": "2026-08-14T19:18:01.610Z",
  "executiveSummary": "An authenticated remote code execution vulnerability has been identified within ImpressCMS, specifically residing in the custom tag module. The vulnerability allows authenticated administrative users to execute arbitrary PHP code on the underlying host operating system.\nThe root cause stems from insecure handling of stored input where malicious payloads configured within custom tags with PHP type enabled are improperly decoded before execution. Specifically, the application applies the undoHtmlSpecialChars() function to HTML-encoded content prior to evaluation via the eval() function within the renderWithPhp() method.\nThis flawed sequence effectively bypasses HTML Purifier sanitization controls designed to neutralize dangerous inputs. Once the malicious custom tag is successfully stored, the crafted payload is automatically triggered and executed on every frontend page load via the application's integrated preload event system.\nThe risk implications are critical, as successful exploitation results in complete application compromise and arbitrary code execution within the context of the web server process. Attack requirements mandate authenticated access with administrative privileges to configure and save custom tags containing the PHP payload.",
  "technicalDetails": "The vulnerability affects the custom tag module within ImpressCMS, impacting the administrative component responsible for creating and managing dynamic content tags. The attack vector requires authenticated administrative access to the backend management interface.\nThe root cause of the vulnerability lies in improper input sanitization and insecure deserialization or evaluation of stored data. When an administrator creates or modifies a custom tag with the PHP execution type enabled, the supplied input undergoes processing by HTML Purifier to strip potentially malicious markup. However, the internal rendering logic subsequently invokes the undoHtmlSpecialChars() function on the stored string prior to passing it directly into the native PHP eval() function inside the renderWithPhp() method.\nBy leveraging undoHtmlSpecialChars(), the application reverses HTML entity encoding, neutralizing the protective sanitization achieved earlier by HTML Purifier. This allows raw PHP syntax and control structures to be stored within the database without interference.\nThe exploitation flow proceeds step-by-step as follows: First, the authenticated attacker navigates to the custom tag module administrative interface. Second, the attacker crafts a malicious payload containing arbitrary PHP execution code and assigns it to a new or existing custom tag configured for PHP evaluation. Third, upon saving, the application stores the payload in the database. Fourth, because the custom tag module hooks into the application's preload event system, the malicious tag is loaded and evaluated via renderWithPhp() on every subsequent frontend page request.\nWhen any client requests a page on the ImpressCMS frontend, the preload event triggers the evaluation of the stored custom tag. The renderWithPhp() method retrieves the payload, decodes the HTML-encoded characters via undoHtmlSpecialChars(), and executes the resulting PHP code via eval(). This achieves persistent remote code execution, granting the attacker the ability to manipulate application data, access sensitive database contents, or execute system commands depending on host server permissions."
}