ImpressCMS contains a flaw in its custom tag module that permits an authenticated administrator to store malicious payloads in PHP‑type custom tags. The application decodes the tag content with undoHtmlSpecialChars() and then passes it directly to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization. When any frontend page loads, the preload event system triggers the evaluated code, resulting in arbitrary PHP execution on the web server.

The vulnerability affects all ImpressCMS installations that employ the custom tag module with PHP‑type tags enabled. No specific version numbers are identified by the CNA, so all releases containing this module could be impacted.

The CVSS score of 8.6 classifies this as a high‑severity flaw, indicating substantial potential impact on confidentiality, integrity, and availability. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires administrator authentication; once logged in, an attacker can create or modify a custom tag to trigger eval, executing PHP code with the privileges of the web server process. This elevates the threat to full control within the web application. Based on the description, it is inferred that the code may also affect the underlying server if PHP runs with elevated rights.