CVE-2026-90788
magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Sep 14, 2026
- Updated
- Sep 16, 2026
- Reserved
- Sep 13, 2026
Description
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
MacCMS10magicblack |
|
References
- VDB-403294 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injectionvdb-entry
- VDB-403294 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-90788 | CVE Analysis and Reportthird-party-advisory
- Submit #919268 | MacCMS MacCMS10 maccms10-2026.1000.4055 OS Command Injectionthird-party-advisory
- https://github.com/magicblack/maccms10/issues/1378exploitissue-tracking
- https://github.com/magicblack/maccms10/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.