Schlix CMS 2.2.6-6 contains a vulnerability that allows an authenticated attacker to execute arbitrary PHP code by abusing the block manager’s extension upload functionality. The flaw is a classic code injection (CWE-94) where malicious PHP embedded in a crafted ZIP file’s packageinfo.inc is executed when an administrator accesses the About tab of the installed extension. Successful exploitation gives an attacker full control over the web server, compromising confidentiality, integrity, and availability of the entire application and underlying system.

The affected products are Schlix CMS from Schlix. The CVE specifically enumerates version 2.2.6‑6 as vulnerable. While other nearby releases (e.g., 2.2.7‑2, 2.2.8‑1, 2.1.8‑7, 2.2.1‑3) are listed in the CPE data, the advisory focuses on the 2.2.6‑6 build. Administrators running that version or at risk of deploying the same block manager configuration should address the issue immediately.

The CVSS score of 8.7 places this flaw in the high severity range. Exploitation requires valid authentication to access the block manager, reducing opportunistic attack likelihood, yet once authenticated, the attacker can run any PHP code. The EPSS score is unavailable, and it has not yet been listed in the CISA KEV catalog, but the high base score warrants proactive mitigation.