Password Hash Weakness in YzmCMS by YzmCMS Vendor

CVE-2026-105156

What is CVE-2026-105156?

A vulnerability has been identified in YzmCMS versions up to 7.6, specifically in the password handling function within the MD5 Handler located in /common/function/system.func.php. This issue allows an attacker to manipulate the password argument, resulting in a password hash that is generated with insufficient computational effort. The attack can be executed remotely, although it requires a high level of complexity, making exploitation challenging. Publicly available exploits have been released, raising concerns about potential attacks. In response, the vendor plans to implement a backwards-compatible gradual hash migration feature in the upcoming release scheduled for March 2027, alongside interim security mitigation guidance in their official documentation for existing users to reduce associated risks.

References