CVE-2026-94103 Details
Description
A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A remote code execution vulnerability has been identified in RooCMS versions through 1.4.0. The issue arises in the Frontend Rendering component, specifically within the eval function of roocms/site_pagePHP.php and roocms/site_blocks.php. The vulnerability allows for code injection by manipulating the content argument, which is then executed via eval(). This exploitation can be carried out remotely. The vulnerability exists because RooCMS uses eval() to execute PHP code from the database, and the application's encoding mechanisms fail to provide adequate protection against such injections.
To address this vulnerability, RooCMS users are advised to implement a strict PHP function whitelist, disable dangerous functions through the php.ini configuration, set open_basedir restrictions, add CSRF protection and secondary authentication for ACP operations that modify PHP content, and log all executed code from eval() along with operator information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/boyslikesports/202607_vul_dir/blob/main/RooCMS-C1-EN.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-94103 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/893004 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408033 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408033/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RooCMS | <= 1.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |