CVE-2026-54611 - OSV

Osv.Dev • September 9, 2026

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Git / github.com/instantsoft/icms2

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Two Remote Code Execution Vulnerabilities Disclosed in Content Management Systems Two critical vulnerabilities were disclosed on September 8, 2026, affecting content management systems. CVE-2026-86732, rated 8.7 (High), impacts Craft CMS versions before 5.10.12, allowing authenticated users to execute arbitrary PHP code via the element-index endpoint. Attackers can exploit this by injecting malicious classes through specific parameters. CVE-2026-54611, rated 5.5 (Medium), affects InstantCMS versions prior to 2.18.2, enabling remote authenticated attackers to upload malicious components that can execute PHP code through custom .htaccess files. Both vulnerabilities have been patched in their respective latest versions. Users are advised to update their systems immediately to mitigate potential risks. 4 sources 57

Extracted Entities

CVE-2026-54611 - OSV

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (3)