CVE-2026-54611

MediumCVSS 5.5

Published: 08/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

42th percentile - higher than 42% of all known CVEs

Summary

InstantCMS prior to version 2.18.2 has a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Risk Assessment

An attacker can take over the server, leading to full compromise of the system and data.

Recommendation

Immediately update InstantCMS to version 2.18.2 or later.

Other vulnerabilities in InstantCMS

CVE-2026-48707Low
InstantCMS versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

Original NVD description (English source)

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS