---
id: CVE-2026-73679
title: ImpressCMS Authenticated RCE via PHP Custom Tag eval()
summary: >-
  ImpressCMS contains an authenticated remote code execution vulnerability in
  the custom tag module that allows authenticated administrators to execute
  arbitrary PHP code by storing a malicious payload in a custom tag with PHP
  type enabled…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: ImpressCMS
product: ImpressCMS
affected:
  - ImpressCMS <= 2.0.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-17T15:57:53.109863Z'
published: '2026-08-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:19:10.655Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73679'
references:
  - url: 'https://github.com/ImpressCMS/impresscms'
    label: Product Repository
  - url: 'https://github.com/DevVaibhav07/VULN-POC/blob/main/ImpressCMSRCCE.md'
    label: Public Reference
  - url: >-
      https://www.vulncheck.com/advisories/impresscms-authenticated-rce-via-php-custom-tag-eval
tags:
  - cve.org
epss: 0.0061
epssPercentile: 0.4788
ingestedAt: '2026-09-24T15:45:56.705Z'
---

## Overview

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

## Affected

- `ImpressCMS <= 2.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.