CVE-2026-30993

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30993", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-16T14:06:34.679Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-15T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-15T17:24:08.072Z"}, "descriptions": [{"lang": "en", "value": "Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/slah-informatica-eval-injection-rce"}, {"url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30993"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:05:46.925300Z", "id": "CVE-2026-30993", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:06:34.679Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30993", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T14:05:46.925300Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:06:27.228Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/slah-informatica-eval-injection-rce"}, {"url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30993"}], "descriptions": [{"lang": "en", "value": "Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-15T17:24:08.072Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30993", "state": "PUBLISHED", "dateUpdated": "2026-04-16T14:06:34.679Z", "dateReserved": "2026-03-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-15T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input."}, {"lang": "es", "value": "Slah CMS v1.5.0 y versiones anteriores se descubri\u00f3 que conten\u00eda una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en la funci\u00f3n session() en config.php. Esta vulnerabilidad es explotable mediante una entrada manipulada."}], "id": "CVE-2026-30993", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30993", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T14:05:46.925300Z", "version": "2.0.3"}}]}, "published": "2026-04-15T18:16:59.913", "references": [{"source": "cve@mitre.org", "url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30993"}, {"source": "cve@mitre.org", "url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/slah-informatica-eval-injection-rce"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.0]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "slah_cms", "vendor": "slah_cms"}], "analysis": {"en": {"generated_at": "2026-04-17T08:26:29.122741+00:00", "value": {"mitigation_remediation": ["Upgrade Slah CMS to a version newer than 1.5.0", "If an upgrade is not immediately possible, disable or remove the vulnerable session() function from the configuration", "Restrict web access to config.php and other sensitive files and implement strict input validation on session parameters"], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Slah CMS installations running version 1.5.0 and any earlier release. Users of these versions should verify their CMS version and apply any available updates.", "description_and_impact": "A flaw in the session() function defined in Slah CMS 1.5.0 and earlier permits an attacker to execute arbitrary code on the server by submitting specially crafted input. The vulnerability arises from insufficient validation of data passed to the session function, allowing injection of executable payloads. Successful exploitation would give the attacker full control over the affected system, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "Because the flaw enables remote code execution, its severity is critical as indicated by a CVSS score of 9.8. The EPSS score is less than 1%, indicating limited current exploitation probability, but the high severity signals a substantial threat. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring that the attacker can send a crafted request to the vulnerable endpoint; no authentication or local privileges are required. While no concrete exploitation evidence is documented, the nature of the vulnerability warrants immediate attention."}}}}, "created": "2026-04-15T19:30:12.405418+00:00", "title": "Remote Code Execution via Session Function in Slah CMS", "updated": "2026-04-17T08:30:13.702017+00:00", "vendors": ["slah_cms", "slah_cms$PRODUCT$slah_cms"], "weaknesses": ["CWE-94"]}