CVE-2026-54611: InstantCMS Component Installer RCE Vulnerability

CVE-2026-54611 Overview

InstantCMS, a free and open source content management system, contains a Remote Code Execution (RCE) vulnerability in its component installer. Authenticated attackers can upload a malicious component that is not formally installed, but whose files are written into the upload directory and then executed. The upload directory normally blocks PHP execution, but attackers can bypass this restriction by uploading a custom .htaccess file that re-enables PHP handling. The flaw is tracked as CWE-94: Improper Control of Generation of Code and affects all versions prior to 2.18.2.

Critical Impact
Authenticated attackers with administrative installer access can execute arbitrary PHP code on the server, leading to full application compromise.

Affected Products

InstantCMS versions prior to 2.18.2
InstantCMS icms2 component installer
Fixed in InstantCMS 2.18.2

Discovery Timeline

2026-09-08 - CVE-2026-54611 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-54611

Vulnerability Analysis

The vulnerability resides in the InstantCMS component installer workflow. When an administrator uploads a component package, the installer extracts files into the upload directory before validating whether the component should be installed. Even when installation is rejected, the extracted files remain on disk. Attackers exploit this by including a malicious .htaccess file in the package alongside PHP payloads. The .htaccess file overrides the directory's default deny rules for PHP execution, allowing the attacker to invoke the uploaded PHP files directly via HTTP.

Root Cause

The root cause is improper control of generated code [CWE-94] combined with insufficient isolation of the extraction directory. The installer wrote package contents into a web-accessible location without stripping or blocking .htaccess files, and without ensuring that PHP execution remained disabled regardless of package contents. The upload folder relied on a directory-level configuration that user-supplied files could override.

Attack Vector

Exploitation requires an authenticated account with permission to invoke the component installer. The attacker crafts a component archive containing arbitrary PHP files and a .htaccess file that enables PHP execution for that directory. After uploading the package, the attacker requests the PHP file directly through the web server, which executes the payload under the web server user's context.

php

// Security patch in system/controllers/admin/actions/install_finish.php
// Source: https://github.com/instantsoft/icms2/commit/44f3a9d04a3207c82cdc756599cbdf084a02858f
 */
class actionAdminInstallFinish extends cmsAction {

    use \icms\controllers\admin\traits\packageInstallerTrait;

    public function run() {

        if (!cmsForm::validateCSRFToken($this->request->get('csrf_token', ''))) {

The fix introduces the packageInstallerTrait, which routes package handling through a temporary directory that is not web-accessible, removing the ability to reach uploaded files directly. Source: instantsoft/icms2 commit 44f3a9d.

Detection Methods for CVE-2026-54611

Indicators of Compromise

Unexpected .htaccess files inside the InstantCMS upload directory tree, particularly containing AddHandler, AddType, or SetHandler directives referencing PHP.
New or modified PHP files in upload paths that normally contain only static assets.
Web server access log entries requesting .php resources from upload directories following a component installation attempt.

Detection Strategies

Audit component installer activity in InstantCMS administrative logs for failed or partial installations followed by direct HTTP requests to upload paths.
Monitor file integrity on the InstantCMS webroot, alerting on any creation of .htaccess or .php files outside expected code directories.
Inspect uploaded component archives for .htaccess entries or PHP files placed outside the expected component structure before allowing installation.

Monitoring Recommendations

Enable verbose logging for the InstantCMS admin controller actionAdminInstallFinish and correlate with subsequent web requests.
Alert on HTTP 200 responses to .php requests under upload or media directories where PHP execution should be disabled.
Track administrative account activity for anomalous component installation attempts, especially from newly created or privilege-escalated accounts.

How to Mitigate CVE-2026-54611

Immediate Actions Required

Upgrade InstantCMS to version 2.18.2 or later, which contains the official fix.
Review the upload directory for unauthorized .htaccess and .php files and remove any that were not deployed by the application.
Rotate administrative credentials for accounts that had access to the component installer prior to patching.
Review web server access logs for suspicious .php requests to upload paths and investigate any hits as potential compromises.

Patch Information

The patch is delivered in InstantCMS 2.18.2. It refactors the installer to use a packageInstallerTrait that stages package contents in a temporary directory outside the web root, preventing direct HTTP access to extracted files. See the GitHub Security Advisory GHSA-vvgv-h28h-p2m5 and the upstream commit for full details.

Workarounds

Enforce a server-level configuration that disables PHP execution in upload directories and cannot be overridden by per-directory .htaccess files, for example by setting AllowOverride None on the upload path in Apache.
Restrict access to the InstantCMS component installer to a minimal set of trusted administrators.
Block uploads that contain .htaccess files at the reverse proxy or WAF layer until the patch is applied.

bash

# Apache configuration example to prevent .htaccess override and PHP execution in uploads
<Directory "/var/www/instantcms/upload">
    AllowOverride None
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>