Description
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MetInfo CMS | MetInfo CMS | 7.9.0 – ≤ 8.1.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
kandasirah/php-rce-2026 ★ 0 · Oct 21, 2026
Lab RCE PHP 2026: replika MetInfo CMS <=8.1 (CVE-2026-29014, unauth PHP code injection) + harness diferensial PHP core CVE-2026-109618/109619. Diegofinisikan untuk localhost (127.0.0.1) saja, lengkap…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- MetInfo CMS <= 8.1 - Remote Code Execution http/cves/2026/CVE-2026-29014.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://karmainsecurity.com/KIS-2026-06 technical-description exploit
- https://www.metinfo.cn/ product
- https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce third-party-advisory