CVE-2026-29014

Summary

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Affected Software

Weaknesses

• CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')

ADP Enrichment

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2026/Apr/1
• https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://karmainsecurity.com/KIS-2026-06
• https://www.metinfo.cn/
• https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce

• ←Previous
• Next→