CVE-2026-6652
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A weakness has been identified in Pagekit CMS up to 1.0.18, affecting the evaluate function in app/modules/view/src/PhpEngine.php (StringStorage Template Handler component). The manipulation causes improper neutralization of directives in dynamically evaluated code, enabling remote exploitation; the exploit is publicly available and the vendor did not respond to the disclosure.
Risk Assessment
This may allow an attacker to achieve remote code execution or other unwanted actions in the application. Public availability of the exploit increases the risk of active exploitation.
Recommendation
Restrict or disable access to the vulnerable component, consider applying community patches, or migrate away from the unmaintained Pagekit CMS since the vendor did not respond to the disclosure.
Other vulnerabilities in Pagekit CMS
See all- CVE-2017-5594High
An issue was discovered in Pagekit CMS before 1.0.11 that allows a remote attacker to reset a registered user's password when the debug toolbar is enabled. The password can be successfully recovered using this exploit.
- CVE-2025-67165Critical
Pagekit CMS version 1.0.18 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows attackers to escalate privileges.
- CVE-2025-67164Critical
Pagekit CMS version 1.0.18 contains an authenticated arbitrary file upload vulnerability in the /storage/poc.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2026-88756Medium
Pagekit CMS up to version 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
- CVE-2026-57518High
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Original NVD description (English source)
A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS