MacCMS10’s administrative template editor filters PHP functions through a blacklist regex that unintentionally omitted functions such as exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Because ThinkPHP’s {if} template tag embeds the condition directly as raw PHP, an authenticated administrator can inject code like {if condition="exec('id > /tmp/pwned.txt')"} and achieve remote code execution. The flaw enables an attacker to run arbitrary system commands, read or write files, and otherwise compromise the server’s confidentiality, integrity, and availability.

The vulnerability affects the MagicBlack MacCMS10 CMS platform in all releases prior to the patch applied on 2026‑06‑22. No specific version numbers are listed in the advisory, so any installation of MacCMS10 before that commit is potentially vulnerable.

The CVSS base score of 7.2 indicates a moderate‑to‑high severity vulnerability, and while the EPSS score is not available, the lack of an EPSS measurement suggests limited publicly known exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would need authenticated access to the administrative interface and ability to edit templates. Once achieved, code execution can be performed directly through the template engine without additional user interaction.