CVE-2026-71232 — MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

CVE-2026-71232

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE PUBLISHED

Description (CNA)

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

Affected (CNA)

Vendor / product	Versions
magicblack / maccms10	affected 0 through 10

CWE

CWE-94

References

https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.