VULNERABILITY INTELLIGENCE
CVE-2026-61523
CVSS score8.6 HIGH
EPSS probability1.19%
CISA KEVNot currently listed
Published2026-08-03
Last modified2026-10-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')