CVE-2026-94103: RooCMS Frontend Code Injection Vulnerability

CVE-2026-94103 Overview

CVE-2026-94103 is a code injection vulnerability affecting RooCMS versions up to 1.2.2, 1.3.4, and 1.4RC2. The flaw resides in the eval function call within roocms/site_pagePHP.php, part of the Frontend Rendering component. Attackers can manipulate the content argument to inject arbitrary PHP code. The vulnerability is remotely exploitable but requires high privileges on the target instance. Public exploit details have been disclosed, and the vendor did not respond to the disclosure attempt.

Critical Impact
Authenticated remote attackers with high privileges can inject and execute arbitrary PHP code on RooCMS installations, compromising confidentiality, integrity, and availability of the affected application.

Affected Products

RooCMS up to version 1.2.2
RooCMS up to version 1.3.4
RooCMS version 1.4RC2

Discovery Timeline

2026-09-21 - CVE-2026-94103 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94103

Vulnerability Analysis

The vulnerability is a code injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected code path in roocms/site_pagePHP.php passes user-influenced input through PHP's eval construct without proper sanitization. When the content parameter is processed by the Frontend Rendering component, an authenticated attacker can supply crafted PHP syntax that the interpreter executes in the application's context.

Because the code executes with the privileges of the PHP process, successful exploitation can lead to arbitrary command execution, file manipulation, and database access. The attack requires network access and authenticated high-privilege context, which limits mass exploitation but remains a concern for insider threats and post-compromise scenarios.

Root Cause

The root cause is the use of eval on data derived from the content argument without input validation or output encoding. Any dynamic PHP evaluation on untrusted or partially trusted data creates a direct code execution primitive. The RooCMS rendering logic does not enforce a whitelist of permitted expressions or use a safer template engine.

Attack Vector

Exploitation occurs over the network against the RooCMS frontend. The attacker must authenticate with high privileges before manipulating the content parameter passed to site_pagePHP.php. Once injected, the payload is evaluated during page rendering, executing attacker-supplied PHP.

No verified proof-of-concept code is included here. Technical write-ups are available in the GitHub RooCMS Vulnerability Report and VulDB CVE-2026-94103 Details.

Detection Methods for CVE-2026-94103

Indicators of Compromise

Unexpected PHP files or webshells appearing under RooCMS installation directories, particularly near roocms/site_pagePHP.php.
Web server access logs showing authenticated POST or GET requests containing PHP syntax (e.g., <?php, system(, passthru(, base64_decode() in the content parameter.
Outbound network connections from the PHP worker process to unfamiliar external hosts following administrative page edits.

Detection Strategies

Monitor HTTP request bodies and query strings targeting site_pagePHP.php for PHP language tokens or encoded payloads in the content field.
Alert on modifications to PHP source files within the RooCMS application directory outside of official update windows.
Correlate high-privilege authentication events with subsequent execution of shell commands by the PHP-FPM or Apache worker process.

Monitoring Recommendations

Enable PHP disable_functions monitoring and log any invocation of eval, exec, system, or proc_open originating from the RooCMS codebase.
Aggregate web server, PHP error, and OS-level process telemetry into a centralized data lake to enable cross-source correlation.
Review administrator session activity for anomalous page-content submissions containing executable syntax.

How to Mitigate CVE-2026-94103

Immediate Actions Required

Restrict access to RooCMS administrative interfaces to trusted IP ranges using network ACLs or a reverse proxy.
Audit and reduce the number of accounts holding high-privilege roles capable of editing page content.
Rotate credentials for all administrative accounts and enforce multi-factor authentication on the hosting infrastructure.

Patch Information

No vendor patch is available at the time of publication. The vendor was contacted but did not respond to the disclosure. Organizations running RooCMS should track the VulDB Vulnerability #408033 entry for updates and consider migrating to an actively maintained CMS if no fix is released.

Workarounds

Remove or disable the vulnerable eval call in roocms/site_pagePHP.php if in-house PHP expertise is available, replacing dynamic evaluation with static template rendering.
Deploy a web application firewall (WAF) rule to block requests containing PHP tags or dangerous function names in the content parameter.
Set the PHP disable_functions directive to block eval-equivalent execution where feasible, and run the PHP process under a least-privilege system account.

bash

# Example WAF-style pattern to block PHP tokens in the content parameter
# (adapt to your WAF syntax, e.g., ModSecurity, Nginx, or Cloudflare rules)
SecRule ARGS:content "@rx (?i)(<\?php|eval\s*\(|system\s*\(|passthru\s*\(|base64_decode\s*\()" \
  "id:1094103,phase:2,deny,status:403,msg:'RooCMS CVE-2026-94103 code injection attempt'"