{"id":"CVE-2026-54611","title":"InstantCMS is a free and open source content management system","summary":"InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possi…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-94","CWE-434"],"vendor":"instantsoft","product":"icms2","affected":["icms2 < 2.18.2"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T18:16:59.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54611","references":[{"url":"https://github.com/instantsoft/icms2/commit/44f3a9d04a3207c82cdc756599cbdf084a02858f","label":"security-advisories@github.com"},{"url":"https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5","label":"security-advisories@github.com"},{"url":"https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T17:39:33.556580Z"},"epss":0.00515,"epssPercentile":0.42885,"ingestedAt":"2026-09-08T18:07:34.916Z","slug":"CVE-2026-54611","body":"## Overview\n\nInstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201768,"id":"CVE-2026-54611","ts":1789399703089,"field":"exploit_available","old":"false","new":"true"},{"seq":200498,"id":"CVE-2026-54611","ts":1789397355773,"field":"exploit_available","old":"true","new":"false"},{"seq":198415,"id":"CVE-2026-54611","ts":1789391922443,"field":"exploit_available","old":"false","new":"true"},{"seq":196208,"id":"CVE-2026-54611","ts":1789383559011,"field":"exploit_available","old":"true","new":"false"},{"seq":195137,"id":"CVE-2026-54611","ts":1789380450334,"field":"exploit_available","old":"false","new":"true"},{"seq":193924,"id":"CVE-2026-54611","ts":1789378474847,"field":"exploit_available","old":"true","new":"false"},{"seq":192711,"id":"CVE-2026-54611","ts":1789376384038,"field":"exploit_available","old":"false","new":"true"},{"seq":191498,"id":"CVE-2026-54611","ts":1789373379382,"field":"exploit_available","old":"true","new":"false"},{"seq":190283,"id":"CVE-2026-54611","ts":1789369269647,"field":"exploit_available","old":"false","new":"true"},{"seq":189070,"id":"CVE-2026-54611","ts":1789368246298,"field":"exploit_available","old":"true","new":"false"},{"seq":187853,"id":"CVE-2026-54611","ts":1789365126448,"field":"exploit_available","old":"false","new":"true"},{"seq":186640,"id":"CVE-2026-54611","ts":1789363233007,"field":"exploit_available","old":"true","new":"false"},{"seq":185426,"id":"CVE-2026-54611","ts":1789361074046,"field":"exploit_available","old":"false","new":"true"},{"seq":184213,"id":"CVE-2026-54611","ts":1789358116899,"field":"exploit_available","old":"true","new":"false"},{"seq":182464,"id":"CVE-2026-54611","ts":1789354196240,"field":"exploit_available","old":"false","new":"true"},{"seq":181257,"id":"CVE-2026-54611","ts":1789353100232,"field":"exploit_available","old":"true","new":"false"},{"seq":180050,"id":"CVE-2026-54611","ts":1789350139850,"field":"exploit_available","old":"false","new":"true"},{"seq":178843,"id":"CVE-2026-54611","ts":1789348062649,"field":"exploit_available","old":"true","new":"false"},{"seq":177636,"id":"CVE-2026-54611","ts":1789346255452,"field":"exploit_available","old":"false","new":"true"},{"seq":176429,"id":"CVE-2026-54611","ts":1789342983409,"field":"exploit_available","old":"true","new":"false"},{"seq":174546,"id":"CVE-2026-54611","ts":1789334733713,"field":"exploit_available","old":"false","new":"true"},{"seq":173341,"id":"CVE-2026-54611","ts":1789333464680,"field":"exploit_available","old":"true","new":"false"},{"seq":172155,"id":"CVE-2026-54611","ts":1789330973561,"field":"exploit_available","old":"false","new":"true"},{"seq":170969,"id":"CVE-2026-54611","ts":1789328585698,"field":"exploit_available","old":"true","new":"false"},{"seq":169764,"id":"CVE-2026-54611","ts":1789327038218,"field":"exploit_available","old":"false","new":"true"},{"seq":168559,"id":"CVE-2026-54611","ts":1789323640352,"field":"exploit_available","old":"true","new":"false"},{"seq":167354,"id":"CVE-2026-54611","ts":1789319474579,"field":"exploit_available","old":"false","new":"true"},{"seq":166149,"id":"CVE-2026-54611","ts":1789318527427,"field":"exploit_available","old":"true","new":"false"},{"seq":164944,"id":"CVE-2026-54611","ts":1789315675426,"field":"exploit_available","old":"false","new":"true"},{"seq":163739,"id":"CVE-2026-54611","ts":1789313433573,"field":"exploit_available","old":"true","new":"false"},{"seq":162534,"id":"CVE-2026-54611","ts":1789311801042,"field":"exploit_available","old":"false","new":"true"},{"seq":161329,"id":"CVE-2026-54611","ts":1789308506817,"field":"exploit_available","old":"true","new":"false"},{"seq":160834,"id":"CVE-2026-54611","ts":1789304441059,"field":"exploit_available","old":"false","new":"true"},{"seq":160381,"id":"CVE-2026-54611","ts":1789303968032,"field":"exploit_available","old":"true","new":"false"},{"seq":159442,"id":"CVE-2026-54611","ts":1789300377809,"field":"exploit_available","old":"false","new":"true"},{"seq":158672,"id":"CVE-2026-54611","ts":1789299464935,"field":"exploit_available","old":"true","new":"false"},{"seq":157636,"id":"CVE-2026-54611","ts":1789296561868,"field":"exploit_available","old":"false","new":"true"},{"seq":156431,"id":"CVE-2026-54611","ts":1789294562669,"field":"exploit_available","old":"true","new":"false"},{"seq":155226,"id":"CVE-2026-54611","ts":1789292764229,"field":"exploit_available","old":"false","new":"true"},{"seq":154021,"id":"CVE-2026-54611","ts":1789289568151,"field":"exploit_available","old":"true","new":"false"},{"seq":152671,"id":"CVE-2026-54611","ts":1789281472626,"field":"exploit_available","old":"false","new":"true"},{"seq":152311,"id":"CVE-2026-54611","ts":1789281065703,"field":"exploit_available","old":"true","new":"false"},{"seq":151272,"id":"CVE-2026-54611","ts":1789277511431,"field":"exploit_available","old":"false","new":"true"},{"seq":150233,"id":"CVE-2026-54611","ts":1789276046586,"field":"exploit_available","old":"true","new":"false"},{"seq":149200,"id":"CVE-2026-54611","ts":1789273706415,"field":"exploit_available","old":"false","new":"true"},{"seq":148167,"id":"CVE-2026-54611","ts":1789271089893,"field":"exploit_available","old":"true","new":"false"},{"seq":146202,"id":"CVE-2026-54611","ts":1789269266572,"field":"exploit_available","old":"false","new":"true"},{"seq":142815,"id":"CVE-2026-54611","ts":1789261342317,"field":"exploit_available","old":"true","new":"false"},{"seq":141646,"id":"CVE-2026-54611","ts":1789258721585,"field":"exploit_available","old":"false","new":"true"},{"seq":140487,"id":"CVE-2026-54611","ts":1789256564340,"field":"exploit_available","old":"true","new":"false"}]}