CVE-2026-94103 RooCMS CVE debrief

Who should care

Defenders responsible for RooCMS installations, especially in remote deployment contexts, should assess exposure to this code injection vulnerability and prioritize verification and potential remediation.

Why it matters

Defenders should prioritize verifying exposure of RooCMS installations to this code injection vulnerability, especially in remote deployment contexts, and consider compensating controls for unpatched instances.

• Verify exposure of RooCMS installations to code injection
• Assess remote deployment contexts for potential attack vectors
• Consider compensating controls for unpatched RooCMS instances

Technical summary

The vulnerability impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering in RooCMS up to 1.2.2/1.3.4/1.4RC2, leading to code injection. The attack can be launched remotely. Defenders responsible for RooCMS installations, especially in remote deployment contexts, should assess exposure to this code injection vulnerability and prioritize verification and potential remediation. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 2 and severity of LOW.

Defensive priority

Defenders should prioritize verifying exposure of RooCMS installations to this code injection vulnerability, especially in remote deployment contexts.

Recommended defensive actions

• Verify RooCMS installations for exposure to this code injection vulnerability
• Assess remote deployment contexts for potential attack vectors
• Consider compensating controls for unpatched RooCMS instances
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 2 and severity of LOW. However, the vendor did not respond to early disclosure. The vulnerability was found in RooCMS up to 1.2.2/1.3.4/1.4RC2 in the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. This leads to code injection. The attack can be launched remotely.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.