CVE-2026-71232 Details

A remote code execution vulnerability exists in MacCMS10's admin template editor, specifically in the file application/admin/controller/Template.php. The issue arises because the template editor's blacklist regex, intended to block dangerous PHP functions, omitted several critical functions including exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. This oversight allows an authenticated administrator to inject a payload using ThinkPHP's {if} template tag, which directly embeds the condition into raw PHP. As a result, the injected command could be executed, leading to remote code execution.

Users can update to the version of MacCMS10 that includes the patch for this vulnerability, specifically the release following the commit on June 22, 2026, which added the missing functions to the blacklist filter.