CVE-2026-105156: Password Hash With Insufficient Computational Effort in YzmCMS

This vulnerability affects the Password function in /common/function/system.func.php of YzmCMS versions 7.0 through 7.6. The issue is that the password hashing uses insufficient computational effort, specifically in the MD5 Handler component, which weakens password security. An attacker can manipulate the password argument remotely to exploit this weakness. The attack is complex and difficult to execute. The vendor has acknowledged the issue and intends to implement a gradual hash migration feature in the next release scheduled for March 2027, with interim mitigation guidance to be published.

The vulnerability reduces the strength of password hashes by using insufficient computational effort, potentially making it easier for attackers to perform offline password cracking if they obtain hashed passwords. However, the attack complexity is high and exploitability is difficult, and there is no indication of direct privilege escalation or remote code execution. The vulnerability could weaken authentication security but requires significant effort to exploit.

The vendor has not yet released an official patch but plans to implement a backward-compatible gradual hash migration feature in the next release scheduled for March 2027. Until then, the vendor will publish security mitigation guidance on their official documentation to help reduce risk. Users should monitor the vendor's official channels for this guidance and apply it accordingly. No immediate patch is currently available.