CVE-2026-57518
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Risk Assessment
The risk for the organization includes potential takeover of the CMS system by an authenticated user, leading to arbitrary PHP code execution on the server, data theft, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately update Pagekit CMS to the latest version that fixes this vulnerability and restrict the 'user: manage users' permission to trusted administrators only.
Other vulnerabilities in Pagekit CMS
See all- CVE-2017-5594High
An issue was discovered in Pagekit CMS before 1.0.11 that allows a remote attacker to reset a registered user's password when the debug toolbar is enabled. The password can be successfully recovered using this exploit.
- CVE-2025-67165Critical
Pagekit CMS version 1.0.18 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows attackers to escalate privileges.
- CVE-2025-67164Critical
Pagekit CMS version 1.0.18 contains an authenticated arbitrary file upload vulnerability in the /storage/poc.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file.
Original NVD description (English source)
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.