This vulnerability lies in the evaluate function of the StringStorage Template Handler in Pagekit CMS up to version 1.0.18. The function uses PHP's eval without properly neutralizing directives in dynamically evaluated code, allowing a malicious user to inject and execute arbitrary PHP code on the server. The weakness is classified as code injection (CWE‑94) and eval injection (CWE‑95). Remote attackers can exploit the flaw through web inputs that reach the evaluate routine, leading to full remote code execution on the affected system.

The flaw affects Pagekit CMS installations running any version up to and including 1.0.18. The vulnerable code resides in app/modules/view/src/PhpEngine.php within the StringStorage Template Handler component. All sites that rely on this component for rendering templates without a newer fixed release are susceptible.

The CVSS score of 5.1 indicates a moderate baseline severity, but the publicly available exploit elevates the practical risk. Because the attack vector is remote, the exploitation requires only access to parts of the CMS that submit or process templates. Although the vulnerability is not listed in the CISA KEV catalog, the existence of a public exploit and the lack of vendor response increase the likelihood of abuse. Administrators should treat this as a medium-risk flaw that could enable remote code execution if not addressed promptly.