CVE-2026-57518: Pagekit CMS 1.0.18 Privilege Escalation & Remote Code Execution

Technical summary

CVE-2026-57518 is a missing authorization check in UserApiController::saveAction() within Pagekit CMS 1.0.18. An authenticated user with 'user: manage users' permission can invoke the affected action to assign themselves arbitrary custom roles without proper authorization validation. By assigning a role containing the 'system: manage packages' permission, the attacker gains access to the admin package management interface. The package installer accepts PHP files, allowing upload and execution of arbitrary code in the application context. The vulnerability combines improper access control (CWE-862) with unsafe package handling to enable unauthenticated remote code execution from an initially low-privilege state.

Business impact

This vulnerability creates a critical escalation path from user management to full system compromise. Any staff member, contractor, or account holder with basic user administration rights can seize administrative control and execute arbitrary code on web servers hosting Pagekit. This threatens data confidentiality (database access, file theft), integrity (site defacement, data modification), and availability (service disruption, ransomware deployment). Organizations using Pagekit for public-facing sites, content management, or multi-tenant deployments face rapid lateral movement and persistent access scenarios.

Affected systems

Pagekit CMS version 1.0.18 and likely earlier versions are affected. The vulnerability requires valid user credentials and the 'user: manage users' permission, limiting initial exposure to internal staff, trusted partners, or accounts created through administrative enrollment. Public Pagekit installations accessible to untrusted users carrying such permissions are at highest risk. Verify your Pagekit deployment version and review user permission assignments immediately.

Exploitability

Exploitability is straightforward for authenticated users holding the specified permission. No user interaction, network traversal, or advanced techniques are required—the authorization bypass is direct and the package upload mechanism is a built-in feature. Attack surface is confined to authenticated sessions, but permission assignment is often granted liberally in many content management configurations. Exploitation leaves audit trails in user role assignments and package upload logs, though these may not be monitored in real time.

Remediation

Upgrade Pagekit CMS to a patched version released after 2026-07-14 (verify against the vendor advisory for exact version number). Patch availability from the Pagekit project should be confirmed before deployment. As an interim control, audit user role assignments and restrict the 'user: manage users' permission to only trusted administrative staff. Disable or restrict access to the package management interface at the application level if not in active use. Implement file upload validation and restrict executable file types in package uploads.

Patch guidance

Consult the official Pagekit project repository and security advisories for the patched version addressing CVE-2026-57518. Apply updates in a test environment first to verify compatibility with custom themes, plugins, and extensions. Review release notes for any breaking changes. After patching, audit user roles and permissions to ensure no unauthorized privilege elevation occurred during the vulnerability window. Restart the application server to ensure the patched code is active.

Detection guidance

Monitor UserApiController::saveAction() calls via application logs, focusing on POST/PUT requests assigning roles to user accounts. Alert on creation of custom roles with 'system: manage packages' permission, particularly if assigned during unusual hours or by low-privileged accounts. Review package upload logs in the admin package installer for PHP files or suspicious packages installed immediately after role modifications. Host-based monitoring should flag PHP package execution and new code writes to application directories. Check user_roles and package tables in the database for unexplained changes post-patch.

Why prioritize this

This vulnerability scores 8.8 (HIGH) with CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network accessibility, low attack complexity, and requirement for low-privilege authentication. The chain from privilege escalation to remote code execution is direct and requires no additional exploitation steps. Although not yet in the CISA KEV catalog, the technical simplicity and business impact warrant immediate patching. Organizations should prioritize Pagekit instances with multiple user accounts or public-facing deployments.

Risk score, explained

The CVSS 8.8 score reflects the combination of network accessibility (AV:N), straightforward exploitation for authenticated users (AC:L, PR:L, UI:N), and severe impact across confidentiality, integrity, and availability (C:H, I:H, A:H). While authentication is required (PR:L), the permission threshold is commonly assigned in multi-user CMS environments. The lack of exploits in the wild and KEV listing may lower practical real-world impact in monitored environments, but the ease of exploitation and blast radius warrant high priority nonetheless.

Frequently asked questions