CVE-2026-6652 | Pagekit CMS up to 1.0.18 StringStorage Template PhpEngine.php evaluate eval injection

A vulnerability marked as critical has been reported in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code.

This vulnerability is registered as CVE-2026-6652. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.