6.3
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue.
Засегнати продукти
- n/a TallCMS: 4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8.0
Вид слабост
История
- 5 октомври 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-105329
- https://nvd.nist.gov/vuln/detail/CVE-2026-105329
- https://vuldb.com/vuln/413543
- https://vuldb.com/vuln/413543/cti
- https://vuldb.com/cve/CVE-2026-105329
- https://vuldb.com/submit/979800
- https://github.com/tallcms/tallcms/issues/122
- https://github.com/tallcms/tallcms/pull/124
- https://github.com/beegoodit/tallcms/commit/fdc18f4c6a36134f8986ca1d7e4e97092e3deb93
- https://github.com/tallcms/tallcms/