{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71232", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T10:53:53.175Z", "datePublished": "2026-08-05T10:56:15.883Z", "dateUpdated": "2026-08-05T12:53:53.406Z"}, "containers": {"cna": {"title": "MacCMS10: Incomplete Function Blacklist in Template Editor Enables Authenticated RCE", "descriptions": [{"lang": "en", "value": "MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition=\"exec('id > /tmp/pwned.txt')\"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Code Injection", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "magicblack", "product": "maccms10", "programFiles": ["application/admin/controller/Template.php"], "versions": [{"version": "0", "lessThan": "10", "versionType": "custom", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"}], "credits": [{"lang": "en", "value": "Mirdavlatov Mira'zam", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T10:56:15.883Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T12:53:18.041904Z", "id": "CVE-2026-71232", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:53:53.406Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71232", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T12:53:18.041904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:53:49.866Z"}}], "cna": {"title": "MacCMS10: Incomplete Function Blacklist in Template Editor Enables Authenticated RCE", "credits": [{"lang": "en", "type": "finder", "value": "Mirdavlatov Mira'zam"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "magicblack", "product": "maccms10", "versions": [{"status": "affected", "version": "0", "lessThan": "10", "versionType": "custom"}], "programFiles": ["application/admin/controller/Template.php"], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"}], "descriptions": [{"lang": "en", "value": "MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition=\"exec('id > /tmp/pwned.txt')\"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Code Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T10:56:15.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71232", "state": "PUBLISHED", "dateUpdated": "2026-08-05T12:53:53.406Z", "dateReserved": "2026-08-05T10:53:53.175Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T10:56:15.883Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{}

{}

{"created": "2026-08-05T12:30:12.420384+00:00", "updated": "2026-08-05T12:30:12.420389+00:00", "vendors": []}