CVE-2026-30993 describes a remote code execution vulnerability in Slah CMS v1.5.0 and below, specifically in the session() function of config.php. An attacker can exploit this vulnerability by sending crafted input that leads to arbitrary code execution on the affected system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), which typically involves injection of malicious code that is then executed. The CVSS 3.1 base score of 9.8 indicates a critical risk with network attack vector, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the server running Slah CMS, potentially leading to full system compromise. This can result in unauthorized access, data theft, modification, or destruction, and disruption of service. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected application, implement web application firewalls with rules to detect and block suspicious input targeting the session() function, and monitor for unusual activity. Avoid exposing the vulnerable CMS to untrusted networks. Do not rely on generic mitigations unless specifically advised by the vendor.