CVE-2026-105329

TallCMS PluginManager ThemeManager.php code injection

State: Published
Severity: 5.3 Medium
Published: Oct 5, 2026
Updated: Oct 7, 2026
Reserved: Oct 5, 2026

Description

A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
TallCMSn/a	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8.0Affected

References

VDB-413543 | TallCMS PluginManager ThemeManager.php code injectionvdb-entry
VDB-413543 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-105329 | CVE Analysis and Reportthird-party-advisory
Submit #979800 | tallcms 4.8.0 Code Injectionthird-party-advisory
https://github.com/tallcms/tallcms/issues/122exploitissue-tracking
https://github.com/tallcms/tallcms/pull/124issue-trackingpatch
https://github.com/beegoodit/tallcms/commit/fdc18f4c6a36134f8986ca1d7e4e97092e3deb93patch
https://github.com/tallcms/tallcms/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.