CVE-2026-29014
Published: 01 April 2026
Summary
CVE-2026-29014 is a critical-severity Code Injection (CWE-94) vulnerability in Metinfo Metinfo. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability tracked as CVE-2026-29014 and assigned CWE-94. The flaw stems from insufficient input neutralization in the execution path, enabling remote attackers to supply malicious PHP code via crafted requests and achieve arbitrary code execution.
Unauthenticated remote attackers can exploit the issue over the network with low attack complexity to obtain remote code execution and full control of the affected server, as reflected in its CVSS 4.0 score of 9.3. The EPSS score has remained in a narrow band around 0.32 with a peak of 0.3318. Multiple public references, including advisories from KarmaInSecurity and VulnCheck, provide further technical detail on the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17875
Vulnerability details
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path…
more
to achieve remote code execution and gain full control over the affected server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated PHP code injection in a public-facing CMS (MetInfo), enabling remote attackers to achieve RCE via crafted requests, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input to block the malicious PHP code supplied in crafted requests.
Enforces access control decisions on the execution path, preventing unauthenticated attackers from reaching the vulnerable code-injection functionality.
Deploys malicious-code protection mechanisms that can block or alert on attempts to execute injected PHP payloads.