Critical severity · published Apr 1, 2026
CVE-2026-29014
MetInfo CMS Unauthenticated PHP Code Injection RCE
9.8
CVSS
39.5%
EPSS
No
On KEV
Description
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)39.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MetInfo CMS · MetInfo CMS
7.9.0 through 8.1.0 · source: vendor
ME
Metinfo · Metinfo
7.9; 8.0.0; 8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29014
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29014
Exploit
https://karmainsecurity.com/KIS-2026-06
Product
https://www.metinfo.cn/
Third Party Advisory
https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce
Mailing List
http://seclists.org/fulldisclosure/2026/Apr/1
Exploit
https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a