CVE-2026-95501 Overview
CVE-2026-95501 is a code injection vulnerability in mtrano APENCMS affecting the eval function within cms/weasel.php, part of the Template Engine component. Attackers can manipulate the $_CMS['site'] argument to inject and execute arbitrary code remotely. The product uses a rolling release system, so no fixed version identifiers exist for affected or patched builds. The vendor was contacted about this disclosure but did not respond. A public exploit is available, increasing the risk of opportunistic abuse. The vulnerability is classified under CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).
Critical Impact
Authenticated remote attackers can inject code executed by PHP eval, potentially leading to arbitrary code execution within the CMS process context.
Affected Products
- mtrano APENCMS (rolling release, up to commit 6546096d354153309693efabb9a0d824628ed4f5)
- Template Engine component (cms/weasel.php)
- Deployments exposing the CMS to untrusted network input
Discovery Timeline
- 2026-09-22 - CVE-2026-95501 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-95501
Vulnerability Analysis
The vulnerability resides in cms/weasel.php, where the Template Engine passes the $_CMS['site'] argument into a PHP eval call without adequate neutralization. Because eval executes any syntactically valid PHP string, an attacker who can influence $_CMS['site'] can supply code that runs inside the CMS process. Exploitation requires network reachability and user interaction, and requires high privileges to reach the vulnerable path. The impact spans confidentiality, integrity, and availability of the CMS runtime. A public exploit has been referenced through VulDB entry 408349, which raises the practical exploitation risk for internet-exposed instances. The rolling release model complicates version-based triage, so operators must rely on commit-level identifiers.
Root Cause
The root cause is unsafe use of PHP eval on data derived from the $_CMS['site'] variable inside the Template Engine. There is no allowlist or sanitization enforced on the input prior to evaluation. This pattern maps directly to [CWE-74] injection weaknesses, where downstream interpreters process untrusted input as executable content.
Attack Vector
An authenticated attacker with the ability to influence template rendering parameters submits a crafted payload that reaches the eval sink in cms/weasel.php. Because the attack path requires user interaction, exploitation typically involves tricking a privileged user into triggering the vulnerable request, or chaining with a lower-privilege flaw that provides the required context.
No verified proof-of-concept code is available for redistribution. Refer to the VulDB CVE-2026-95501 entry for further technical detail.
Detection Methods for CVE-2026-95501
Indicators of Compromise
- Unexpected outbound network connections initiated by the PHP process hosting APENCMS.
- Web server access logs containing suspicious payloads targeting parameters that map to $_CMS['site'].
- New or modified PHP files in the CMS webroot following requests to cms/weasel.php.
- Anomalous child processes (for example, sh, bash, curl, wget) spawned by the PHP-FPM or web server worker.
Detection Strategies
- Inspect HTTP request bodies and query strings for PHP language constructs (system(, passthru(, base64_decode(, backticks) directed at APENCMS endpoints.
- Enable PHP audit logging or extensions such as Snuffleupagus to flag runtime eval calls with tainted input.
- Correlate authenticated CMS sessions with subsequent process-execution telemetry on the underlying host.
Monitoring Recommendations
- Baseline expected process ancestry for the PHP interpreter and alert on deviations.
- Monitor file integrity for cms/weasel.php and other Template Engine files to detect tampering or webshell placement.
- Forward web server, PHP, and host telemetry to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-95501
Immediate Actions Required
- Restrict network access to APENCMS administrative interfaces using firewalls, VPNs, or reverse proxy allowlists.
- Rotate credentials for any high-privilege CMS accounts that could reach the vulnerable code path.
- Audit cms/weasel.php and adjacent Template Engine files for indicators of prior exploitation.
Patch Information
The vendor did not respond to disclosure attempts, and no official patch has been published. Because APENCMS uses a rolling release model, operators should track the upstream repository directly and validate any post-6546096d354153309693efabb9a0d824628ed4f5 commits that touch cms/weasel.php for a security-relevant fix. Review the VulDB advisory for updates.
Workarounds
- Remove or replace the eval call in cms/weasel.php with a safe template rendering mechanism if local modification is feasible.
- Apply web application firewall rules that block PHP code constructs in request parameters targeting the Template Engine.
- Enforce least privilege on CMS accounts so that fewer users can reach the vulnerable path requiring high privileges.
- Consider taking the CMS offline until a verified upstream fix is available if exposure cannot be adequately restricted.
# Example WAF rule pattern (ModSecurity) to block PHP code injection attempts
SecRule ARGS "@rx (?:eval\s*\(|system\s*\(|passthru\s*\(|base64_decode\s*\(|`.*`)" \
"id:1095501,phase:2,deny,status:403,msg:'Possible CVE-2026-95501 exploitation attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.