CVE-2026-88418: CMSimple 5.24 CSRF to RCE Vulnerability

CVE-2026-88418 Overview

CVE-2026-88418 affects CMSimple 5.24, a flat-file content management system. The vulnerability chains a Cross-Site Request Forgery (CSRF) weakness with a stored code injection flaw in the CMSimple scripting engine. CSRF protection ships disabled by default, and administrator sessions rely solely on cookie authentication. An attacker who lures an authenticated administrator to a malicious page can force the browser to submit a forged content-save request. The injected payload persists in content/content.php and is executed by PHP eval() on every subsequent page view, granting persistent remote code execution to any visitor, including unauthenticated users.

Critical Impact

A single click by a logged-in administrator on an attacker-controlled page results in persistent server-side code execution accessible to every site visitor.

Affected Products

• CMSimple 5.24
• Installations with default configuration (CSRF protection disabled)
• Any deployment using the built-in evaluate_cmsimple_scripting() handler in functions.php

Discovery Timeline

• 2026-09-22 - CVE CVE-2026-88418 published to the National Vulnerability Database (NVD)
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88418

Vulnerability Analysis

The flaw combines two weaknesses in CMSimple 5.24. First, CSRF protection is disabled by default, so the internal csrfProtection() routine performs no validation on state-changing admin requests. Admin forms also omit the csrf_token hidden field, leaving no server-side or client-side token to validate. Second, administrator authentication depends only on browser cookies, without any origin, referer, or per-request token check.

Any cross-site request submitted with an authenticated administrator's cookies is accepted as legitimate. The attacker uses this to save content containing a CMSimple scripting marker. The evaluate_cmsimple_scripting() function in functions.php parses these markers and dispatches the marker body to PHP eval() during page rendering. Because rendering occurs for every visitor, the injected code runs in an unauthenticated context on each page load, producing persistent server-side code execution.

Root Cause

The root cause is an unsafe combination of Insecure Default Configuration and use of eval() on stored user-controlled content. Disabling CSRF enforcement by default nullifies the framework's own protection routine. Rendering stored content through eval() promotes any successful write to full code execution.

Attack Vector

The attack requires no credentials on the target site. The adversary hosts a page that auto-submits a form to the CMSimple admin content-save endpoint. When a signed-in administrator visits this page, the browser attaches session cookies and the write succeeds. The scripting marker is stored in content/content.php and executed by evaluate_cmsimple_scripting() on every subsequent page request, granting the attacker persistent PHP execution on the web server. See the GitHub CVE Issue Discussion for a technical description of the request flow.

No verified proof-of-concept code is published in the referenced sources. The vulnerability chain is described in prose only.

Detection Methods for CVE-2026-88418

Indicators of Compromise

• Unexpected modifications to content/content.php containing CMSimple scripting markers or PHP function calls such as system, exec, passthru, or base64_decode.
• Web server access logs showing POST requests to CMSimple admin content-save endpoints with a Referer header pointing to an external domain.
• Outbound network connections initiated by the PHP worker process to unfamiliar hosts after a page render.
• New administrator accounts or file uploads that do not correspond to legitimate change tickets.

Detection Strategies

• Perform file integrity monitoring on content/content.php, functions.php, and other CMSimple core files, alerting on any change outside a change window.
• Inspect HTTP request logs for admin write endpoints where the Origin or Referer header is missing or off-domain.
• Scan stored content for CMSimple scripting delimiters combined with PHP function tokens known to enable code execution.

Monitoring Recommendations

• Forward web server, PHP error, and file integrity logs to a centralized analytics platform for correlation.
• Alert on PHP processes spawning shell interpreters such as sh, bash, or cmd.exe.
• Track administrator session activity and flag content-save actions originating from unusual client IP addresses or user agents.

How to Mitigate CVE-2026-88418

Immediate Actions Required

• Enable CSRF protection in the CMSimple configuration so that csrfProtection() enforces token validation on admin state-changing requests.
• Restrict access to the CMSimple admin interface by IP allowlist or VPN until a fix is applied.
• Instruct administrators to log out of CMSimple before browsing untrusted sites and to use a dedicated browser profile for administration.
• Audit content/content.php for unauthorized scripting markers or PHP code and restore from a known-good backup if tampering is found.

Patch Information

No vendor patch is referenced in the available advisory data. Monitor the GitHub CVE Issue Discussion and the CMSimple project for a fixed release. Until a fix is published, apply the configuration and access controls listed above.

Workarounds

• Set CSRF protection to enabled in the CMSimple configuration and confirm that admin forms include and validate the csrf_token field.
• Add a reverse proxy or web application firewall rule that blocks admin write endpoints when the Origin or Referer header is not the site's own domain.
• Configure administrator session cookies with SameSite=Strict and Secure attributes to prevent cross-site cookie attachment.
• Disable or remove use of the CMSimple scripting feature that routes stored content through PHP eval() if it is not required.

# Configuration example - refer to CMSimple documentation for exact syntax
# Enable CSRF protection in the CMSimple config file
csrf_protection = "true"

# Harden session cookie handling at the PHP level
session.cookie_samesite = "Strict"
session.cookie_secure = 1
session.cookie_httponly = 1