CVE-2026-30993 Details

A remote code execution vulnerability has been identified in Slah CMS versions through 1.5.0. The issue arises in the session() function within config.php, where user input is not properly sanitized before being passed to the eval() function. This flaw allows unauthenticated remote attackers to execute arbitrary commands on the server, potentially leading to a full system compromise.

Users are advised to update Slah CMS to the latest patched version available from the vendor. The eval() function should be replaced with a secure alternative, such as a switch-case or a whitelist-based mapping, to prevent user input from being executed as code.