CVE-2026-73679

Name of the Vulnerable Software and Affected Versions ImpressCMS (affected versions not specified)

Description An authenticated remote code execution issue exists in the custom tag module. Authenticated administrators can execute arbitrary PHP code by storing a malicious payload in a custom tag with the PHP type enabled. The application uses the undoHtmlSpecialChars() function to decode HTML-encoded content before passing it to the eval() function within the renderWithPhp() method, which bypasses HTML Purifier sanitization. The payload is then triggered on every frontend page load via the preload event system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.