PatchSiren cyber security CVE debrief
CVE-2026-36239 PbootCMS CVE debrief
A code injection vulnerability has been identified in PbootCMS v.3.2.11 within its site configuration functionality. The vulnerability was published to the CVE Program on 26 May 2026. At this time, no CVSS score or severity rating has been assigned by NVD, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The vendor attribution is currently marked as requiring review due to low confidence in the canonical source identification.
- Vendor
- PbootCMS
- Product
- PbootCMS 3.2.11
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-27
Who should care
Organizations operating PbootCMS v.3.2.11 instances, particularly those exposing administrative configuration interfaces to broader networks. Security teams responsible for content management system security and vulnerability management programs tracking emerging CVE disclosures.
Technical summary
CVE-2026-36239 describes a code injection vulnerability affecting PbootCMS version 3.2.11, specifically located in the site's configuration functionality. Code injection in configuration interfaces typically allows attackers with appropriate access to execute arbitrary code through manipulated configuration values, potentially leading to complete system compromise. The vulnerability was disclosed on 26 May 2026. No CVSS vector or CISA KEV listing is currently available. Organizations using PbootCMS should monitor for vendor security updates and apply defense-in-depth controls on administrative interfaces pending patch availability.
Defensive priority
medium
Recommended defensive actions
- Review PbootCMS site configuration access controls and restrict administrative interfaces to trusted networks
- Monitor for security advisories from the PbootCMS project regarding patched versions
- Assess deployment of PbootCMS v.3.2.11 within your environment and consider upgrade paths pending vendor guidance
- Implement input validation and output encoding for configuration parameters as defense-in-depth
- Subscribe to NVD updates for this CVE to receive CVSS scoring and CPE assignments when available
Evidence notes
The CVE record indicates PbootCMS version 3.2.11 as the affected product. Source references include the PbootCMS project domain and a GitHub repository attributed to a researcher identifier. The vulnerability status in NVD is currently 'Received', indicating initial processing without completed analysis.
Official resources
public