CVE-2026-14749: mjperpinosa stumasy RCE Vulnerability

CVE-2026-14749 Overview

CVE-2026-14749 is a code injection vulnerability in the mjperpinosa/stumasy PHP application through commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The flaw resides in the eval function call within application/pages/imba_calculator/calculate.php. Attackers can manipulate the mathematical_sentence argument to inject arbitrary PHP code executed on the server. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit exists, and the project maintainer has not responded to the disclosure. Because stumasy uses a rolling release model, no fixed version is available.

Critical Impact
Remote, unauthenticated attackers can inject and execute arbitrary PHP code by supplying crafted input to the mathematical_sentence parameter processed by eval().

Affected Products

mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be
Component: application/pages/imba_calculator/calculate.php
Rolling release — no discrete fixed version published

Discovery Timeline

2026-07-05 - CVE-2026-14749 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14749

Vulnerability Analysis

The vulnerability is a code injection flaw classified under [CWE-74]. The stumasy application exposes an IMBA calculator endpoint that accepts a user-supplied expression in the mathematical_sentence parameter. Instead of parsing this input with a safe mathematical evaluator, the handler passes it directly to PHP's eval() construct. Any PHP syntax placed inside mathematical_sentence is interpreted and executed with the privileges of the PHP process, typically the web server user. The attack is reachable over the network and requires no privileges or user interaction.

Root Cause

The root cause is unsanitized input flowing into a dynamic code execution sink. The calculate.php handler treats attacker-controlled data as trusted PHP source. There is no allowlist for arithmetic tokens, no expression parser, and no encoding of input before evaluation. Any request that reaches the endpoint can substitute arbitrary PHP statements for a mathematical expression.

Attack Vector

An attacker submits an HTTP request to the calculator endpoint with a crafted mathematical_sentence value. The payload can invoke PHP functions such as system, exec, passthru, or file_put_contents to execute operating system commands, drop web shells, exfiltrate data, or pivot into the underlying host. Because stumasy is intended for student management workflows, successful exploitation exposes stored records and database credentials referenced by the application.

No verified proof-of-concept code is reproduced here. Refer to the public issue tracker
and VulDB entries listed in the references for technical details on payload construction.

Detection Methods for CVE-2026-14749

Indicators of Compromise

HTTP requests to application/pages/imba_calculator/calculate.php containing PHP tokens such as system(, exec(, passthru(, base64_decode(, or backticks in the mathematical_sentence parameter
Unexpected child processes spawned by the PHP or web server user (for example sh, bash, curl, wget)
New or modified .php files under the web root that were not deployed by the application maintainers
Outbound network connections from the web server to unfamiliar hosts shortly after requests to the calculator endpoint

Detection Strategies

Deploy web application firewall rules that inspect the mathematical_sentence parameter and block characters outside a numeric and operator allowlist
Enable PHP audit logging and alert when eval() is invoked inside calculate.php with non-numeric input
Correlate web access logs with process execution telemetry to catch command execution originating from the PHP worker

Monitoring Recommendations

Monitor file integrity on the stumasy web root to detect dropped web shells or backdoors
Track process lineage under the web server account and flag shell interpreters or network utilities as children of PHP-FPM or Apache
Ingest web server access logs into a centralized data lake and hunt for anomalous query strings targeting the calculator endpoint

How to Mitigate CVE-2026-14749

Immediate Actions Required

Remove or disable the IMBA calculator endpoint at application/pages/imba_calculator/calculate.php until a fix is applied
Restrict network access to the stumasy application to trusted networks or authenticated users only
Audit the web root for unauthorized files and review recent web server logs for exploitation attempts
Rotate any secrets, database credentials, or API tokens accessible to the web server process

Patch Information

No vendor patch is available. The project uses a rolling release strategy, and the maintainer has not responded to the issue report referenced in the GitHub Issue Tracker. Track updates through the GitHub PoC Repository and the VulDB Vulnerability Details entry.

Workarounds

Replace the eval() call with a safe expression parser that accepts only numeric tokens and arithmetic operators
Apply strict server-side input validation using a regular expression such as ^[0-9+\-*/().\s]+$ before any evaluation
Deploy a web application firewall rule that rejects PHP language constructs in query parameters targeting the calculator endpoint
Run the PHP worker under a least-privilege account with disable_functions set to block system, exec, passthru, shell_exec, and proc_open

bash

# Example php.ini hardening for the stumasy host
disable_functions = system,exec,passthru,shell_exec,proc_open,popen,eval
allow_url_include = Off
allow_url_fopen = Off
open_basedir = /var/www/stumasy:/tmp