---
id: CVE-2026-54611
title: InstantCMS is a free and open source content management system
summary: >-
  InstantCMS is a free and open source content management system. Versions prior
  to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote
  authenticated attackers to execute any PHP code via the component installer.
  It is possi…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-94
  - CWE-434
vendor: instantsoft
product: icms2
affected:
  - icms2 < 2.18.2
published: '2026-09-08'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T18:16:59.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54611'
references:
  - url: >-
      https://github.com/instantsoft/icms2/commit/44f3a9d04a3207c82cdc756599cbdf084a02858f
    label: security-advisories@github.com
  - url: >-
      https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5
    label: security-advisories@github.com
  - url: >-
      https://github.com/instantsoft/icms2/security/advisories/GHSA-vvgv-h28h-p2m5
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T17:39:33.556580Z'
epss: 0.00663
epssPercentile: 0.4959
ingestedAt: '2026-09-08T18:07:34.916Z'
---

## Overview

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.