MacCMS10’s admin template editor attempts to filter dangerous PHP functions through a blacklist regex, but the list fails to cover several critical functions – exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Because users with administrator privileges can edit template files, the omission of these functions enables injection of arbitrary PHP code that is subsequently executed by the web server. This constitutes a code‑injection flaw (CWE‑94) that permits full remote code execution, potentially compromising the confidentiality, integrity, and availability of the host system.

All versions of the MagicBlack MacCMS10 content management system that include the pre‑commit 71ad3bb29570e110d8e973acff68040a3050ddf0 functionality in application/admin/controller/Template.php are affected. The patch that adds the missing functions to the blacklist is contained in that commit, so any installation deployed before this change remains vulnerable. No explicit version numbers are provided, but any release dated prior to the commit is included.

The CVSS base score of 7.2 denotes moderate‑to‑high severity. Although the EPSS score is less than 1%, the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation according to current data. Attackers must first obtain authenticated administrator access to the CMS, which is a significant but not impossible precondition. Once inside, a single injection of PHP code that invokes one of the excluded functions is sufficient to achieve remote code execution with no additional interaction, making the exploitation path straightforward for a knowledgeable attacker.