Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-73679ImpressCMS Authenticated RCE via PHP Custom Tag eval()

High 7.2

In plain English

A high-severity code injection in ImpressCMS from ImpressCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.1%top 33.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

Affected products (as reported)

Vendor	Product	Versions
ImpressCMS	ImpressCMS	0 – through 2.0.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
Public Reference technical-description
https://www.vulncheck.com/advisories/impresscms-authenticated-rce-via-php-custom-tag-eval third-party-advisory