Description

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-14T14:17:19.707Z",
  "pubdate": "2026-09-14T14:17:19.707Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Template Handler component of magicblack MacCMS10 version 2026.1000.4055.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands on the underlying server by manipulating specifically crafted requests to the template management functionality.\nThe affected endpoint, located at /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html, fails to properly sanitize user-supplied input before passing it to system-level execution functions.\nSuccessful exploitation results in full remote code execution (RCE), enabling attackers to compromise the integrity, confidentiality, and availability of the server.\nGiven that public exploit code is available and the vendor has not provided a response or patch, the risk level is critical.\nOrganizations using this version of MacCMS10 are at immediate risk of exploitation.",
  "technicalDetails": "The vulnerability resides within the Template Handler component of MacCMS10 version 2026.1000.4055, specifically triggered through the endpoint /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html.\nThe root cause of this security flaw is improper input validation and sanitization of parameters handled by the template indexing functionality. When the application processes requests directed at this specific file path, it fails to sufficiently neutralize shell metacharacters or sanitize input before it is incorporated into system-level commands executed by the server's backend process.\nThe attack flow commences with a remote attacker crafting a malicious HTTP request targeting the aforementioned endpoint. By injecting shell command sequences (e.g., using pipe operators, backticks, or semicolon separators) into the parameters interpreted by the template handler, the attacker can break out of the intended application logic context.\nUpon receiving the malicious request, the backend PHP environment passes the unsanitized input to an underlying system execution function (such as exec(), system(), or shell_exec()). This causes the server to interpret and execute the attacker-supplied string as a shell command with the privileges of the web server process.\nBecause the application does not enforce sufficient authentication checks or input filtering on this endpoint, the vulnerability is reachable remotely without requiring prior authorization.\nPost-exploitation, an attacker gains the ability to execute arbitrary commands, facilitating the deployment of web shells, exfiltration of sensitive application configuration files (including database credentials), movement within the internal network, or full system compromise.\nThe use of URL-encoded characters in the file path (.%40template%40default%40html%40label.html) suggests that the vulnerability may involve mechanisms that normalize paths or map file-based templates to server-side operations, which the application handles insecurely.\nAs public exploit material is available, threat actors can easily weaponize this vulnerability, leading to automated exploitation attempts."
}