Vulnerability · Published Apr 1, 2026 · Assigned by VulnCheck
CVE-2026-29014MetInfo CMS Unauthenticated PHP Code Injection RCE
Critical 9.8
In plain English
A critical-severity code injection in MetInfo CMS from MetInfo CMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 39.5% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MetInfo CMS | MetInfo CMS | 7.9.0 – through 8.1.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://karmainsecurity.com/KIS-2026-06 technical-description, exploit
- https://www.metinfo.cn/ product
- https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce third-party-advisory
- http://seclists.org/fulldisclosure/2026/Apr/1
- https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a