CVE-2026-71232 — MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted …
Published: 2026-08-05 · CVSS: 7.2 · CVSS 3.1
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7