CVE-2026-71232: MacCMS10 Template Editor RCE Vulnerability

CVE-2026-71232 Overview

CVE-2026-71232 is a code injection vulnerability [CWE-94] in MacCMS10's admin template editor (application/admin/controller/Template.php). The editor enforces a blacklist regular expression against template content to block dangerous PHP functions. The blacklist omitted several sink functions, including exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. When combined with ThinkPHP's {if} template tag, which inlines the condition attribute directly into raw PHP, an authenticated administrator can inject a payload to reach remote code execution. The issue was fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 on 2026-06-22.

Critical Impact
An authenticated administrator can execute arbitrary operating system commands on the web server hosting MacCMS10 by saving a crafted template.

Affected Products

MacCMS10 (magicblack/maccms10)
application/admin/controller/Template.php template editor component
Versions prior to commit 71ad3bb29570e110d8e973acff68040a3050ddf0

Discovery Timeline

2026-06-22 - Patch committed as 71ad3bb29570e110d8e973acff68040a3050ddf0
2026-08-05 - CVE-2026-71232 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71232

Vulnerability Analysis

MacCMS10 uses a denylist approach to sanitize template content submitted through the admin template editor. The controller assigns a $filter regular expression enumerating banned tokens such as eval, system, shell, base64, and phpinfo. Content matching the regex is rejected before being written to disk. This design fails open: any dangerous PHP function omitted from the list passes validation.

Multiple command execution primitives were missing from the pre-patch regex. Functions such as exec, passthru, popen, and show_source all allow direct execution of shell commands or disclosure of source. create_function, register_shutdown_function, and register_tick_function enable arbitrary callback invocation. error_log can write attacker-controlled data to arbitrary files.

Root Cause

The root cause is incomplete denylist filtering [CWE-94]. The regex enumerated a subset of dangerous PHP functions but did not cover the full set of code execution sinks. ThinkPHP's {if condition="..."} template tag compiles the condition attribute directly into <?php if(condition): ?>, so any PHP expression that survives the filter is executed when the template renders.

Attack Vector

Exploitation requires an authenticated administrator session with access to the template editor. The attacker submits a template containing an {if} tag whose condition invokes an unfiltered function. When the affected view is rendered, the injected PHP expression executes in the web server context.

php

// Pre-patch vs. post-patch filter regex in application/admin/controller/Template.php
// Source: https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0

-        $filter = '<\?|php|eval|server|assert|get|post|request|cookie|session|input|env|config|call|global|dump|print|phpinfo|fputs|fopen|global|chr|strtr|pack|system|gzuncompress|shell|base64|file|proc|preg|call|ini|{:|{$|{~|{-|{+|{/';
+        $filter = '<\?|php|eval|server|assert|get|post|request|cookie|session|input|env|config|call|global|dump|print|phpinfo|fputs|fopen|global|chr|strtr|pack|system|gzuncompress|shell|base64|file|proc|preg|call|ini|exec\s*\(|passthru\s*\(|popen\s*\(|show_source\s*\(|create_function\s*\(|register_shutdown_function\s*\(|register_tick_function\s*\(|error_log\s*\(|{:|{$|{~|{-|{+|{/';
         $this->assign('filter',$filter);

         if (Request()->isPost()) {

// Example injected template payload:
// {if condition="exec('id > /tmp/pwned.txt')"}{/if}
// Compiles to: <?php if(exec('id > /tmp/pwned.txt')): ?>

Source: MacCMS10 patch commit 71ad3bb. The diff adds the previously missing functions to the filter regex, closing the bypass.

Detection Methods for CVE-2026-71232

Indicators of Compromise

Template files under the MacCMS10 view directory containing {if condition= tags with function calls such as exec(, passthru(, popen(, show_source(, create_function(, register_shutdown_function(, register_tick_function(, or error_log(.
Unexpected files written by the web server user, for example /tmp/pwned.txt or new files in the webroot.
Web access logs showing POST requests to admin.php template editor endpoints followed by GET requests that render the modified template.

Detection Strategies

Compare deployed templates against a known-good baseline and flag any additions of ThinkPHP conditional tags.
Grep template storage directories for the specific function names added to the post-patch filter.
Monitor PHP process trees for child processes such as sh, bash, id, whoami, or curl spawned by php-fpm or Apache worker processes.

Monitoring Recommendations

Log all administrator authentications to the MacCMS10 admin panel and alert on template edits from unfamiliar IP addresses.
Enable file integrity monitoring on the application/admin/controller/ and template view directories.
Forward web server and PHP-FPM logs to a central location and correlate template-edit POST requests with subsequent shell command executions.

How to Mitigate CVE-2026-71232

Immediate Actions Required

Update MacCMS10 to a build that includes commit 71ad3bb29570e110d8e973acff68040a3050ddf0 or later.
Audit existing templates for {if} tags invoking the newly filtered functions and remove any unauthorized entries.
Rotate administrator credentials and review admin account activity for signs of misuse.

Patch Information

The fix is available in the MacCMS10 repository as commit 71ad3bb29570e110d8e973acff68040a3050ddf0, titled "fix #1357 模板编辑器补全危险函数黑名单拦截". The patch extends the $filter regex in application/admin/controller/Template.php to include exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log, each matched with optional whitespace before the opening parenthesis. See the MacCMS10 patch commit for the full diff.

Workarounds

Restrict access to the admin panel using network controls such as IP allowlists or VPN-only access until the patch can be applied.
Enforce PHP disable_functions in php.ini to block exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and other command execution primitives.
Set the template directory to read-only for the web server user where operationally feasible.

bash

# php.ini hardening example - block PHP execution primitives at the interpreter level
disable_functions = exec,passthru,popen,shell_exec,system,proc_open,show_source,create_function,register_shutdown_function,register_tick_function,error_log,eval,assert

# Restrict template directory writes (adjust path to your MacCMS10 install)
chown -R root:www-data /var/www/maccms10/application/admin/view
chmod -R 750 /var/www/maccms10/application/admin/view