CVE-2026-73679 ImpressCMS CVE debrief

Who should care

Administrators and users of ImpressCMS, especially those with administrative privileges, should be aware of this vulnerability and take necessary precautions to prevent exploitation. Additionally, security teams and vulnerability management teams should prioritize patching and monitoring affected systems to prevent potential attacks.

Technical summary

The vulnerability allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization. This allows attackers to execute arbitrary PHP code on the affected system, potentially leading to system compromise.

Defensive priority

Authenticated administrators can execute arbitrary PHP code via custom tags, posing a high risk to affected systems.

Recommended defensive actions

• Inventory affected systems and verify vendor remediation
• Implement compensating controls, such as restricting access to custom tag functionality
• Monitor for suspicious activity and exception tracking
• Apply vendor patches or updates when available
• Restrict administrative access to sensitive functionality
• Review security logs for potential exploitation attempts
• Conduct regular vulnerability assessments and penetration testing

Evidence notes

The vulnerability allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization. Evidence is limited to source-provided details and CVE metadata. Defenders should verify affected systems, review vendor guidance, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.