CVE-2026-14749: Remote Code Injection in mjperpinosa stumasy Calculator

Technical summary

CVE-2026-14749 is a remote code injection vulnerability in the calculate.php file's eval function within mjperpinosa stumasy. The mathematical_sentence parameter fails to properly sanitize user input before processing, allowing injection of arbitrary code. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-94 (Improper Control of Generation of Code), indicating both output encoding failures and unsafe code generation patterns. The CVSS 3.1 score of 7.3 reflects the network-accessible nature of the vulnerability with no authentication requirement, affecting confidentiality, integrity, and availability.

Business impact

Successful exploitation could grant attackers remote code execution on systems running vulnerable versions, leading to potential data theft, system compromise, or service disruption. For organizations relying on the calculator functionality for production workflows or data processing, this vulnerability represents an immediate operational risk. The availability of public exploits significantly shortens the window between disclosure and active attack campaigns.

Affected systems

mjperpinosa stumasy is affected up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The project follows a rolling release strategy without versioned releases, making it difficult to precisely identify which deployed instances are vulnerable. Any installation updated before the vulnerability fix was committed is at risk.

Exploitability

This vulnerability presents a critical exploitability risk. It requires only network access with no authentication, no user interaction, and no special configuration—conditions satisfied in nearly all deployment scenarios. The presence of publicly available exploits means attackers have ready-to-use tools. The eval function's inherent danger when handling untrusted input makes this particularly easy to exploit.

Remediation

The development team has been notified but has not yet responded or released a fix. Organizations should monitor the project's repository and issue tracker for updates. In the interim, implement network-level access controls to restrict who can reach the calculator application, disable the feature if not essential, or temporarily remove the vulnerable code path. Consider running the application in a restricted environment with minimal privileges.

Patch guidance

Since the project has not yet released a formal patch, verify the project repository for any commits addressing this issue after 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Once patches are available, apply them immediately given the remote code execution nature of the vulnerability. Document the exact commit or release version applied to track remediation across your infrastructure.

Detection guidance

Monitor network logs for requests to /application/pages/imba_calculator/calculate.php containing suspicious parameters in the mathematical_sentence field, particularly those with code syntax or shell metacharacters. Review application logs for eval function errors or unexpected code execution patterns. Implement Web Application Firewall (WAF) rules to block requests containing common code injection payloads. Monitor the affected system for unexpected processes, file modifications, or outbound connections that may indicate post-exploitation activity.

Why prioritize this

This vulnerability merits immediate priority due to four factors: (1) remote code execution severity, (2) no authentication required, (3) public exploits are available, and (4) the development team has not yet responded with a fix. Organizations should treat this as an urgent patching or mitigation effort unless the calculator feature is completely disabled or isolated.

Risk score, explained

The CVSS 7.3 HIGH score reflects a network-accessible vulnerability requiring no user interaction or privileges, affecting multiple security properties (confidentiality, integrity, availability). The combination of remote exploitability, public exploit availability, and lack of vendor response elevates the practical risk beyond the base CVSS score.

Frequently asked questions