Authenticated Remote Code Execution in ImpressCMS Custom Tag Module

CVE-2026-73679

What is CVE-2026-73679?

ImpressCMS is susceptible to an authenticated remote code execution vulnerability present in its custom tag module. This flaw allows authenticated administrators to store and execute arbitrary PHP code by leveraging a malicious payload within a custom tag configured with PHP type enabled. The vulnerability arises from the improper handling of HTML-encoded content, which is improperly decoded and passed to the eval() function in the renderWithPhp() method, therefore bypassing the intended HTML Purifier sanitization. This results in the execution of the malicious code upon every frontend page load through the preload event system, posing significant risks to the integrity and security of the application.

References