CVE-2026-90709: Yot CMS Admin Console RCE Vulnerability

CVE-2026-90709 Overview

CVE-2026-90709 is a code injection vulnerability affecting Yot CMS versions up to 3.3.1. The flaw resides in the eval function within modsys/console/admin.php, part of the Admin Console component. Attackers can manipulate the text POST parameter to inject and execute arbitrary code on the server. Exploitation requires network access and existing high-privilege authentication to the admin console. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact

Authenticated administrators can achieve remote code execution on the underlying web server by submitting crafted input to the admin console text parameter.

Affected Products

• Yot CMS versions up to and including 3.3.1
• modsys/console/admin.php (Admin Console component)
• Deployments exposing the admin console to networked users

Discovery Timeline

• 2026-09-14 - CVE-2026-90709 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90709

Vulnerability Analysis

The vulnerability is a server-side code injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The admin.php script within the modsys/console/ directory passes attacker-controlled input from the text POST parameter directly into PHP's eval construct. Because eval executes any string passed to it as PHP code, an attacker with administrator access can run arbitrary commands in the context of the web server process. The public proof-of-concept confirms end-to-end remote code execution against affected Yot CMS builds.

Root Cause

The root cause is unsafe use of the dynamic eval function against unsanitized user-supplied input. The admin console accepts a text field over HTTP POST and evaluates its contents as PHP without any input filtering, allow-listing, or sandboxing. This design pattern converts any authenticated administrative write path into a direct code execution primitive.

Attack Vector

Exploitation requires network reachability to the admin console and valid high-privilege credentials. An authenticated administrator submits a POST request to modsys/console/admin.php with the text parameter populated with arbitrary PHP payloads. Upon submission, the server evaluates the payload, granting the attacker command execution as the web server user. See the GitHub proof-of-concept for CVE-2026-90709 for the full request structure and payload example.

Detection Methods for CVE-2026-90709

Indicators of Compromise

• POST requests to modsys/console/admin.php containing PHP language constructs such as system(, exec(, passthru(, or base64_decode( in the text parameter
• New or modified PHP files under the Yot CMS web root that were not deployed by administrators
• Unexpected outbound network connections from the web server process following admin console activity
• Web server user spawning shell interpreters such as sh, bash, or cmd.exe

Detection Strategies

• Monitor web server access logs for POST requests to modsys/console/admin.php and inspect body contents where logging permits
• Deploy web application firewall rules that flag PHP keywords and function calls submitted through form parameters
• Correlate admin console authentication events with subsequent process creation events on the host

Monitoring Recommendations

• Enable process-lineage telemetry on hosts running Yot CMS to detect web server processes launching child shells
• Alert on file integrity changes within the Yot CMS installation directory
• Track administrator login patterns and investigate sessions originating from unusual geolocations or IP ranges

How to Mitigate CVE-2026-90709

Immediate Actions Required

• Restrict network access to the Yot CMS admin console using IP allow-listing or VPN-only reachability
• Rotate all administrator credentials and enforce multi-factor authentication where supported
• Audit modsys/console/admin.php request logs for evidence of prior exploitation attempts
• Review the web root for unauthorized files, scheduled tasks, or modified PHP source

Patch Information

No vendor patch has been referenced in the disclosure at the time of publication. Consult the VulDB entry for CVE-2026-90709 for updates on fixed releases and vendor guidance.

Workarounds

• Disable or remove the modsys/console/admin.php endpoint if the admin console feature is not required
• Block POST requests to the admin console at an upstream reverse proxy or web application firewall until a fix is available
• Run the PHP interpreter with disable_functions configured to remove eval-adjacent primitives where operationally feasible

# Example nginx location block to restrict access to the admin console
location ~ ^/modsys/console/admin\.php$ {
    allow 10.0.0.0/8;
    deny all;
    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
}