Description
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.
Published: 2026-10-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a code injection flaw in TallCMS’s PluginManager component, specifically in the ThemeManager.php file, allowing an attacker to execute arbitrary code on the server. A crafted request to the vulnerable endpoint can trigger the injection (inferred from the description), providing remote code execution capability. The weakness is categorized as CWE‑94 (Code Generation) and CWE‑74 (Improper Handling of Special Elements).

Affected Systems

Any TallCMS installation of version 4.8.0 or earlier is affected. The flaw exists within packages/tallcms/cms/src/Filament/Pages/ThemeManager.php in the PluginManager component. Administrators should verify whether their deployment is within this affected range and whether the patch commit fdc18f4c6a36134f8986ca1d7e4e97092e3deb93 has been applied.

Risk and Exploitability

The CVSS v3.1 score of 5.3 indicates a medium severity if exploited. Although the EPSS score is not available, the vulnerability has been publicly disclosed and can be leveraged remotely. It is not listed in the CISA KEV catalog, so no mandatory directive exists; however, the potential for remote code execution warrants prompt action.

Generated by OpenCVE AI on October 5, 2026 at 16:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update TallCMS to a release that includes the patch commit fdc18f4c6a36134f8986ca1d7e4e97092e3deb93 or later, removing the code injection vector.
  • If an immediate update is not possible, disable or remove the PluginManager component from the application configuration to block attack traffic to the vulnerable endpoint.
  • Configure the web server to run under the least privilege account, ensuring that any residual code execution opportunities cannot affect the broader system.

Generated by OpenCVE AI on October 5, 2026 at 16:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.
Title TallCMS PluginManager ThemeManager.php code injection
First Time appeared Tallcms
Tallcms tallcms
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:tallcms:tallcms:*:*:*:*:*:*:*:*
Vendors & Products Tallcms
Tallcms tallcms
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tallcms Tallcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-07T20:49:18.219Z

Reserved: 2026-10-05T09:11:34.753Z

Link: CVE-2026-105329

cve-icon Vulnrichment

Updated: 2026-10-07T20:49:14.127Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T16:17:12.460

Modified: 2026-10-07T21:17:11.587

Link: CVE-2026-105329

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:57:31Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')