Imperia CMS: remote command execution via server-side template injection
Researcher Julien Ahrens from RCE Security discovered a critical vulnerability CVE-2026-110355 in Imperia CMS, an enterprise content management system for websites. The flaw affects the SiteActive mechanism, which handles dynamic page processing, and allows unauthenticated arbitrary code execution on the server. The issue is caused by insufficient validation of user-supplied data passed to the template handler.
To exploit the vulnerability, an attacker sends a specially crafted request to
/cgi-bin/site_active.pl, passing a malicious expression in the TEMPLATE parameter. Using the {SITE_ACTIVE} prefix makes it possible to select a different template processing path and bypass the file name security check. Special characters then terminate the generated include directive, after which PHP code and the <!--postconvert:PHPExec()--> instruction are injected into the page content. In the next stage, the template conversion mechanism recognizes this instruction and passes the injected PHP code to the PHPExec handler, resulting in command execution on the server.Exploiting the vulnerability allows an attacker to execute operating system commands without an account, with the privileges of the CMS process, access application files, modify website content, and potentially establish persistence on the server. The attack requires the SiteActive CGI interface to be enabled, accessible over HTTP, and PHP to be present.
Vulnerabilities
Products