CVE-2026-6652: Pagekit CMS RCE Vulnerability

CVE-2026-6652 Overview

A code injection vulnerability has been identified in Pagekit CMS versions up to 1.0.18. This security flaw affects the evaluate function within the file app/modules/view/src/PhpEngine.php, which is part of the StringStorage Template Handler component. The vulnerability enables improper neutralization of directives in dynamically evaluated code (CWE-94), potentially allowing attackers to inject and execute arbitrary PHP code on vulnerable systems.

Remote exploitation of this vulnerability is possible, and the exploit has been made publicly available. The vendor was contacted about this disclosure but did not respond.

Critical Impact

Successful exploitation could allow remote attackers with high privileges to execute arbitrary code on the server, potentially leading to full system compromise, data theft, or lateral movement within the network.

Affected Products

• Pagekit CMS up to version 1.0.18
• Systems running the vulnerable PhpEngine.php component
• Deployments utilizing StringStorage Template Handler

Discovery Timeline

• 2026-04-20 - CVE-2026-6652 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6652

Vulnerability Analysis

This vulnerability falls under the category of Code Injection (CWE-94: Improper Neutralization of Directives in Dynamically Evaluated Code). The flaw exists in the evaluate function within the PhpEngine.php file, which is responsible for processing template content in the StringStorage Template Handler.

The core issue stems from insufficient input validation and sanitization when processing dynamically evaluated code. PHP's eval() function or similar dynamic code execution mechanisms, when combined with user-controllable input, create dangerous attack surfaces. In this case, template content processed through the StringStorage Template Handler can potentially include malicious PHP directives that are executed by the server.

The vulnerability requires high privileges to exploit, which limits the attack surface but does not eliminate the risk—compromised administrator accounts or insider threats could leverage this weakness for malicious purposes.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-supplied input within the evaluate function of the PhpEngine.php component. The function fails to adequately sanitize or validate template data before it is dynamically evaluated, allowing attackers to inject PHP code that gets executed in the application context.

Dynamic code evaluation is inherently dangerous when applied to untrusted input. The PHP eval() construct executes the passed string as PHP code, making it critical to ensure that any data reaching such functions is strictly controlled and validated. For more information on the risks of PHP eval, see the Medium Article on PHP Eval.

Attack Vector

The attack vector for CVE-2026-6652 is network-based, meaning attackers can exploit this vulnerability remotely without requiring physical access to the target system. However, the attack requires high-level privileges (such as administrator access to the CMS), which serves as a limiting factor.

An attacker with sufficient privileges could craft malicious template content containing PHP code directives. When this content is processed by the vulnerable evaluate function in the StringStorage Template Handler, the injected code would be executed on the server with the same permissions as the web application.

The exploitation flow involves manipulating template data to include malicious PHP payloads that bypass any existing input filters, targeting the vulnerable code path within PhpEngine.php.

Detection Methods for CVE-2026-6652

Indicators of Compromise

• Unusual PHP process execution or spawned child processes from the web server
• Unexpected modifications to template files or StringStorage content within Pagekit CMS
• Suspicious network connections originating from the web server to external hosts
• Anomalous entries in web server access logs indicating template manipulation attempts

Detection Strategies

• Monitor file integrity for changes to app/modules/view/src/PhpEngine.php and related template handler files
• Implement web application firewall (WAF) rules to detect code injection patterns in HTTP requests
• Review Pagekit CMS administrative access logs for unauthorized or suspicious template modifications
• Deploy endpoint detection solutions capable of identifying PHP code injection attempts

Monitoring Recommendations

• Enable verbose logging for the Pagekit CMS application to capture template processing activities
• Configure alerts for any modifications to critical PHP files within the Pagekit installation directory
• Monitor system calls from the web server process for unusual command execution patterns
• Implement SIEM correlation rules to identify potential code injection attack patterns

How to Mitigate CVE-2026-6652

Immediate Actions Required

• Restrict administrative access to Pagekit CMS to trusted personnel only and enforce strong authentication
• Audit all user accounts with template modification privileges and remove unnecessary access
• Implement network segmentation to limit potential lateral movement if exploitation occurs
• Consider temporarily disabling the StringStorage Template Handler functionality until a patch is available

Patch Information

At the time of this publication, no official patch has been released by the vendor. The vendor was contacted regarding this disclosure but did not respond. Organizations using Pagekit CMS should monitor the official project channels for security updates.

For additional vulnerability details, refer to the VulDB Vulnerability Entry #358286 and the related VulDB Submission #794186.

Workarounds

• Restrict access to the Pagekit CMS administrative interface using IP whitelisting or VPN requirements
• Implement additional input validation at the web server or reverse proxy level to filter potentially malicious template content
• Deploy a web application firewall with rules targeting PHP code injection patterns
• Consider migrating to an alternative CMS platform that is actively maintained and receives regular security updates

# Example: Restrict access to Pagekit admin panel via .htaccess
<Directory "/var/www/html/pagekit/admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>