CVE-2022-26265

Deeper analysis

Contao Managed Edition version 1.5.0 contains a remote command execution vulnerability in the php_cli parameter, classified under CWE-78 as improper neutralization of special elements used in an OS command. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no requirements for authentication or user interaction, resulting in complete compromise of confidentiality, integrity, and availability.

An unauthenticated attacker with network access can supply a malicious value to the php_cli parameter and execute arbitrary operating-system commands on the underlying server. Successful exploitation grants the attacker the same privileges as the web-server process, enabling full system takeover, data exfiltration, or deployment of additional malware.

Public references consist of detailed proof-of-concept write-ups hosted on GitHub that describe the injection point and reproduction steps. The EPSS score has reached a peak of 0.7231 with a current value of 0.7154, indicating sustained and elevated exploitation interest since disclosure.