CVE-2026-54611: fallo de gravedad media en instantsoft icms2
InstantCMS has Remote Code Execution in package installer
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.7%
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Productos afectados
instantsoft · icms2CVEs relacionadas — instantsoft icms2
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2025-59055MEDIUMInstantCMS vulnerable to Server-Side Request Forgery via package installerEPSS 0.5%CVE-2024-31213LOWInstantCMS Open Redirect vulnerabilityEPSS 0.4%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%CVE-2026-28281HIGHInstantCMS has Multiple CSRF VulnerabilitiesEPSS 0.2%